topic Re: Whats the best way to verify Identity and Asset framework is properly setup in ES ? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/531687#M9512 <P>The easiest way to confirm that you have identities and assets being collected and presented correctly is with the following two searches.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">|`identities` and |`assets`</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>If those commands produce complete &amp; well formatted output, then it should be working.&nbsp;</P> Thu, 10 Dec 2020 14:27:06 GMT nickhills 2020-12-10T14:27:06Z Whats the best way to verify Identity and Asset framework is properly setup in ES ? https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/531663#M9509 Wed, 02 Dec 2020 09:16:45 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/531663#M9509 damode 2020-12-02T09:16:45Z Re: Whats the best way to verify Identity and Asset framework is properly setup in ES ? https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/531687#M9512 <P>The easiest way to confirm that you have identities and assets being collected and presented correctly is with the following two searches.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">|`identities` and |`assets`</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>If those commands produce complete &amp; well formatted output, then it should be working.&nbsp;</P> Thu, 10 Dec 2020 14:27:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/531687#M9512 nickhills 2020-12-10T14:27:06Z Re: Whats the best way to verify Identity and Asset framework is properly setup in ES ? https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/531786#M9513 <P>I agree with&nbsp;nickhillscpl &amp; it's one of the options listed in the doc:&nbsp;</P><P><A href="https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Verifyassetandidentitydata" target="_blank">https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Verifyassetandidentitydata</A></P> Wed, 02 Dec 2020 23:21:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/531786#M9513 lkutch_splunk 2020-12-02T23:21:21Z Re: Whats the best way to verify Identity and Asset framework is properly setup in ES ? https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/532533#M9538 <P>Another (slightly crude) way is on your fields side bar for sourcetypes that have asset/identity fields (such as user) extracted, you should see the user_ fields with each user header (example: user_email, user_nick, user_first).&nbsp;</P> Wed, 09 Dec 2020 20:41:55 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/532533#M9538 Jhunter 2020-12-09T20:41:55Z Re: Whats the best way to verify Identity and Asset framework is properly setup in ES ? https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/532534#M9539 <P>For assets I believe these are the src_ fields that match the asset header such as</P><P>src_should_update</P><P>src_is_expected</P> Wed, 09 Dec 2020 20:43:16 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Whats-the-best-way-to-verify-Identity-and-Asset-framework-is/m-p/532534#M9539 Jhunter 2020-12-09T20:43:16Z