Additional entity profile configuration

Elevate finding risk using profile levels

When an entity triggers one or more entity profile rules that have been assigned a rule level, the entity is assigned the highest level from these rules as its profile level. This profile level is an indicator of contextual risk and can be used to elevate the risk score assigned to any finding that is associated with that entity going forward. This is performed using risk factors that multiply the risk score using a multiplier.

The following table shows the default multipliers that are assigned to each entity profile level value.

To configure the profile level risk factor integration, complete the following steps:

1. In Splunk Enterprise Security, select Configure, then Exposure Analytics, then Configuration settings.

2. Select the Default configurations tab.

3. The integration for Asset and Identity is not enabled. Under Entity profile, select the Add profile_level to A&I (for risk factors) link next to the line item. This link opens Asset and Identity management.

4. In Asset and Identity management, complete the following steps:

   1. Select the Asset fields tab, then select Add new field.

   2. Add a new field named profile_level.

   3. From the Entity discovery fields menu, select the field named profile_level.

   4. Select Save.

   5. Repeat these steps, as needed, for the User fields tab.

5. Return to Exposure Analytics Configuration settings, refresh the page, and then select the Default configurations tab.

6. Under the Entity profile section, confirm that the required Asset and Identity fields are marked Present with a green check mark.

This process pushes the profile_level field and values from the entity discovery asset and user inventories to the asset and identity lookups respectively. This field value is then used by the risk factors that have been configured for Exposure analytics.

To view or modify the risk factors, in Splunk Enterprise Security select Security content , then Risk factors. You will see the Critical, high, medium, and low risk factors on one side and the logic on the other side.

Configure entity profile rule processing

Entity profile rules for assets and users are processed once per day. When you add an entity profile rule or change its logic, you might need to run the processing search on demand instead of waiting for the next scheduled run.

To change the processing schedule or run the processing search on demand, complete the following steps:

1. Select Configure, then Exposure Analytics, then Configuration settings.

2. Select the Processing searches tab.

3. Under Entity profile, select Run for the asset or user profile rules.

You can also turn off entity profile rule processing searches by changing the toggle next to each search to Off.