Reviewing entity details in Splunk Enterprise Security

Splunk Enterprise Security gives you a structured path from an initial finding to a complete picture of the entity, including its record, associations, risk posture, and network activity. With entity details, you can make a faster, more informed triage decision.

By reviewing entity details, you can identify assets and users using an approach that processes events from your existing data source events. This is most relevant to SOC analysts responding to active alerts, solutions engineers validating security tool coverage, and IT operations staff investigating asset behavior flagged by the SecOps team.

To see entity details, select Mission Control. Then, in the queue you're working in, locate a finding to triage. Select the Entity for that finding.

The entity details dialog box shows a snapshot of relevant information about the entity. This includes entity details, exposures, risk score and detection contribution information.

• If you have not yet configured Exposure Analytics, only the limited data from the Asset and Identity (A&I) lookups is displayed.

• If you have configured Exposure Analytics, then more complete and thorough details are displayed about the entity, including posture and profile information to help add context to investigations.

Select to Open in entity analysis to drill down into the Entity analysis view for more details, where you can view comprehensive details, attributions, findings, and exposures linked to the entity.

For additional details on ERS, see Entity risk scoring.

For additional details on entity discovery fields, see Entity discovery field reference.