Analyze an entity

To analyze an entity, complete the following steps:

  1. Select Analytics, then Exposure analytics, then Entity analysis.

  2. In the Entity search field, enter an asset, user, IP address, or MAC address. For example, enter 20.20.20.20 to analyze an IP address entity.

After you enter an entity, you can explore the results in the Overview tab and analyzing the following:

  • Latest attributions: The first and last seen time of the asset or user and other last attributed data. For example, an asset might have an attributed MAC address, IP address, and user from when it was last seen.

  • Details: Entities discovered by Exposure Analytics display the full set of fields. Entities found only in Asset and Identity lookups (and not in entity discovery) display a limited set of fields.

  • Location: The geographic location associated with the entity.

  • Count of detections, findings, and discovery sources: The number of sources, detections, and findings the entity was found in.

  • Entity posture: Posture metric gaps, based on the configured entity posture metrics for asset or user entities. The posture assurance provides an overall compliance percentage for all in-scope metrics.

  • Entity profile: Profile level and profile tags linked to the entity profile rules that have triggered for the selected asset or user entity. This provides an understanding of contextual risk.

You can further analyze the entity by drilling into other tabs in the Entity analysis view.