topic Re: Do I have to disable asset_lookup_by_cidr? in Splunk Enterprise Security

Do I have to disable asset_lookup_by_cidr?

evelenke — Tue, 29 Sep 2020 20:36:56 GMT

Hi Splunkers,

In our alerts related to Network domain (IDS, netflow, etc), where in logs there's only IP address available we try to enrich IP addresses with all possible data - src_owner, src_dns etc.
src_dns may be correlated from DHCP ACK events or DNS lookup.
But for many assets, like mobile or VMs no authentication may be performed and so there are no source to enrich with src_owner value.

As result owner gets populated from asset_lookup_by_cidr, which is obviously not an appropriate value.

What is purpose and main use case of this lookup in general?
As of now I think it's better to take away at least dns, mac and owner population from this automatic lookup

Re: Do I have to disable asset_lookup_by_cidr?

smoir_splunk — Thu, 26 Jul 2018 17:18:35 GMT

You could choose to enable it selectively by sourcetype, so that the enrichment only occurs for the sourcetypes where it is valuable. See https://docs.splunk.com/Documentation/ES/5.1.0/Admin/Configureassetandidentitycorrelation for the instructions.

Re: Do I have to disable asset_lookup_by_cidr?

evelenke — Tue, 29 Sep 2020 20:37:39 GMT

Thanks for advice.
Actually we require enrichment for many sourcetypes and it should be not by cidr but strict by ip. That's what asset_lookup_by_str does.
In provided recomendation there's no ability to choose sourcetypes for asset_lookup_by_cidr separately from asset_lookup_by_str (at least for ES ver. 4.7, that we have).
Looks like I'll rename output fields for default : LOOKUP-zv-asset_lookup_by_cidr-dest(dvc,src)