Configure entity discovery
Exposure Analytics uses a patented process to discover entities on the network. It examines events in configured data sources and combines information from multiple systems of record to build a unified entity record.
Entity discovery does not ingest data sources into Splunk. Instead, it uses data that is already available in Splunk. Each configured entity discovery source is a search for events in a data source that contains asset-related information. Entity discovery uses a mix of different data sources to discover entities. Some data sources, such as Windows, DHCP, and VPN events, might stream into Splunk in near real time. Others, such as endpoint security and vulnerability data, might arrive in batches through scheduled API pulls. Events from these data sources can share common asset fields but might also have different fields. For example, DHCP events might include hostname, MAC address, and IP address, while an endpoint security source might also provide the operating system and version.
Every few minutes, the entity discovery processing searches over short time windows to process relevant events efficiently. It aggregates information from the configured sources, with each source contributing values for the fields it provides. When multiple sources provide a value for the same field, a prioritization process evaluates the values based on accuracy and timeliness. Enrichment rules, like company subnet information, can also help fill gaps in the entity record.
Entity discovery maintains inventories of assets and users, along with inventories for IP addresses and MAC addresses associated with them. It also retains a full discovery history; recording when an entity was discovered and how its details changed over time. This history supports security investigations and attribution - for example, identifying which user was associated with an asset and IP address at a specific point in time.
The discovery processing is designed to have a low-performance impact. While it runs every few minutes, it does so over short time windows. Current inventories are stored in KV stores, while historical discovery data is written to a summary index.
Each entity discovery processing run searches for asset-related events defined by the configured sources, then aggregates and normalizes the results. It retrieves previously discovered entity records, applies aggregation and prioritization, and uses enrichment rules and other logic to update field values. The resulting records are written to the inventories, and a summary is written to an index. A subset of the asset and user inventory data is also written to the Asset and Identity (A&I) lookups, which allows downstream Splunk Enterprise Security functions to leverage data discovered by Exposure analytics.
The table below outlines the steps to configure entity discovery.
| Step | Setup task | Description | Documentation |
|---|---|---|---|
| 1 | (Required) Configure entity discovery sources | Add relevant sources for entity discovery and pull data from specific events. You can select from predefined sources, or add your own additional sources. | Add an entity discovery source |
| 2 | (Recommended) Populate the company subnet directory | Populate a company subnet directory to enrich discovered assets with additional business and locational data. | |
| 3 | (Optional) Add or modify enrichment rules or rule parameters | Add enrichment rule parameters (such as host naming conventions) to existing enrichment rules to enrich asset or user inventory field values. You can also create new enrichment rules if required. | Edit an entity discovery source |
| 4 | (Optional) Add additional inventory fields | Add your own business-specific additional inventory fields using entity discovery sources. | Create or modify an entity discovery source |
| 5 | (Optional) Customize the enrichment lookups | Define your own lists of default users, or legacy operating systems to further enrich discovery inventories. | |
| 6 |
(Optional) Deploy the Splunk Add-on for Exposure Analytics |
For an additional entity discovery source in Exposure Analytics that leverages the Splunk Universal Forwarder, deploy the Splunk Add-on for Exposure Analytics | Get started with the Splunk Add-on for Exposure Analytics |
| 7 |
(Optional) Modify the entity discovery data populating the Asset and Identity (A&I) lookups |
Modify the subset of entity discovery data used to populate the Asset and Identity lookups in Splunk Enterprise Security | Populate the company subnet directory |
Splunk Add-on for Exposure Analytics
For an additional entity discovery source in Exposure Analytics, install the Splunk Add-on for Exposure Analytics. For details, see Get started with the Splunk Add-on for Exposure Analytics.