Populate Splunk ES Asset and Identity (A&I) lookups with entity discovery data

Overview

Exposure Analytics automatically populates the Asset and Identity lookups in Splunk Enterprise Security with a configurable subset of its entity discovery data. This helps ensure findings, detections, and related workflows in Splunk ES are enriched with accurate, current context.

After Entity discovery is configured and actively discovering assets and users, this functionality is enabled by default.

Using Entity discovery to populate Asset and Identity (A&I) lookups helps:

• Add timely asset and user context to findings and detections

• Improve the accuracy of enrichment in Splunk ES

• Support other Enterprise Security capabilities that depend on A&I data

Understand the difference between entity discovery and A&I lookups

Although both contain asset and identity information, Entity discovery and A&I lookups are different in their approach.

Entity discovery in Exposure Analytics is designed to identify assets and users that are actively present on the network. It continuously updates inventories and tracks relationships between entities over time.

Asset and Identity lookups in the A&I framework may include manually maintained or older data sources. As a result, they can contain assets or identities that are no longer active, records that have not been updated recently and stale or inaccurate context.

By default, only active assets and users discovered by Entity discovery that have been last seen on the network within a configurable number of days are populated into the A&I lookups. This approach:

• Keeps lookup sizes manageable

• Prioritizes relevant, active entities

• Improves enrichment for findings and detections, which typically involve active assets and users

Supported population modes

You can populate the A&I lookups in one of three ways.

1. Entity discovery only

Assets and users discovered by Entity discovery are written to the A&I lookups on a scheduled basis that you define.

In this mode:

• No additional asset or identity lookups are added manually to the A&I framework

• Entity discovery views can be used for filtered asset and user searches

• The Entity analysis view provides full attribution functionality

• Asset and identity data will be accurate and complete

This is the recommended configuration. In this mode, Entity discovery acts as the superset of entity data, and a relevant subset is used to populate the A&I lookups.

2. A&I lookups only

Asset and identity data is maintained manually in the A&I framework and entity discovery is not configured.

In this mode:

• Exposure analytics views are not populated

• The Entity analysis view provides limited functionality, based on the limited data found in the A&I lookups

• Asset and identity data might be inaccurate and stale

3. Entity discovery with additional A&I lookups

Entity discovery is configured and populates the A&I lookups while additional manually maintained A&I lookups are also included.

In this mode

Recommended mode when using Entity discovery

When upgrading Splunk Enterprise Security and planning to use Entity discovery in Exposure Analytics, move to Entity discovery only mode.

To transition from A&I lookups only mode:

1. Configure Entity discovery.

2. Remove or disable all other A&I lookups, except the asset and identity lookups populated by Entity discovery.

It is not recommended to simply reuse existing A&I lookups as Entity discovery sources, unless they are being used only for enrichment. Entity discovery is designed to discover entities from activity in your data sources, and reusing lookups this way does not follow that design.

Existing A&I lookups may contain valuable data for enriching entities discovered by Entity discovery. If you use a lookup as a static source for enrichment and it has no time field indicating network activity, configure it as a Passive source. This prevents the entities in the lookup from being treated as active assets or users. Multi-valued fields in lookup-based Entity discovery sources are not supported. See Using entity discovery sources for enrichment.

Configuring Entity discovery to populate the A&I lookups

By default population of the asset and identity lookups is turned on by default. Once entity discovery within Exposure analytics is configured and asset and users are being discovered, the assets and users discovered within the past 30 days will be populated into the asset and identity lookups, every 15 mins by default.

It is possible to select what data is populated into the A&I lookups and also the frequency that this occurs.

To configure the entity discovery data that is used to populate the lookups, perform the following steps:

1. Navigate to Configure -> All configurations
2. Select Assets and Identities from the Data section
3. Click on the Global settings tab
4. From the panel named Turn on entity discovery population, toggle the Assets and Identities to on
5. Click on the Update entity discovery population dropdown and select either Assets or Identities
6. A new Update entity discovery population modal will appear
7. Population schedule – how often the lookup is populated with new entity discovery data
8. Last seen – how far back the assets or users were last seen or discovered on the network
9. Maximum populated assets/identities – the maximum number of rows populated into the lookup
10. Enter in any logic to filter what is populated into the lookup
11. Click on Preview button to preview the expected data. The number of results will also be displayed
12. Click Save to save the new filter

Once configured and populating A&I, the following lookups are created and added to the asset and identity lookups respectively:

• entity_discovery_assets

• entity_discovery_identities

These lookups are then merged with any other asset or identity lookups to create the main A&I lookups. By default, the Entity discovery-populated lookups are assigned a higher rank so their data takes precedence over older or less reliable lookup sources.

Map additional Entity discovery fields to A&I lookups

Exposure Analytics contains predefined and additional entity fields beyond that of the Asset and Identity lookups. If needed, you can map additional Entity discovery fields into the asset or identity lookups.

1. Navigate to Configure -> All configurations
2. Select Assets and Identities from the Data section
3. Select either Asset fields or Identity fields tab depending on which lookup you are adding entity discovery fields to
4. Click on the Add new field button
5. Complete the field information as required
6. From the Entity discovery fields drop down, select the field from Entity discovery that should map to this field
7. Click Save

The newly mapped field will now be included in the next scheduled population.

You can validate the field is being populated by going to the Global settings tab, then clicking on Update entity discovery population drop down on the Turn on entity discovery population panel. Once loaded, click to preview the results.

Disabling Entity discovery population of A&I lookups

To disable the entity discovery population of the Asset and Identity lookups, follow these steps:

1. Navigate to Configure > All configurations.
2. Select Assets and Identities from the Data section
3. Select the Global settings tab.
4. From the panel named Turn on entity discovery population, toggle the Assets and Identities to off. This will remove the lookups from the Asset and Identity lookups tables