Configure entity discovery

The table below outlines the steps to configure entity discovery.

Note: You must configure entity discovery first, before configuring entity posture, entity profile, or entity actions.
Step Setup task Description Documentation
1 (Required) Configure entity discovery sources Add relevant sources for entity discovery and pull data from specific events. You can select from predefined sources, or add your own additional sources. Add an entity discovery source
2 (Recommended) Populate the company subnet directory Populate a company subnet directory to enrich discovered assets with additional business and locational data.
3 (Optional) Add or modify enrichment rules or rule parameters Add enrichment rule parameters (such as host naming conventions) to existing enrichment rules to enrich asset or user inventory field values. You can also create new enrichment rules if required. Edit an entity discovery source
4 (Optional) Add additional inventory fields Add your own business-specific additional inventory fields using entity discovery sources. Create or modify an entity discovery source
5 (Optional) Customize the enrichment lookups Define your own lists of default users, or legacy operating systems to further enrich discovery inventories.
6

(Optional) Deploy the Splunk Add-on for Exposure Analytics

 For an additional entity discovery source in Exposure Analytics that leverages the Splunk Universal Forwarder, deploy the Splunk Add-on for Exposure Analytics Get started with the Splunk Add-on for Exposure Analytics
7

(Optional) Modify the entity discovery data populating the Asset and Identity (A&I) lookups

 Modify the subset of entity discovery data used to populate the Asset and Identity lookups in Splunk Enterprise Security Populate the company subnet directory

Splunk Add-on for Exposure Analytics

For an additional entity discovery source in Exposure Analytics, install the Splunk Add-on for Exposure Analytics. For details, see Get started with the Splunk Add-on for Exposure Analytics.