Splunk asset and identity wit CMDB integration

[SplunkExplorer]

Hi Splunkers, for our customer we have the need to understand if we can obtain an asset and identity inventory using Splunk. 

I know that, with the Enterprise Security, this can be achieved in many ways, for example with a CMDB; I found a useful link here. The point is that we have not the ES SH; we have only the "classic" SH, in a SaaS solution. Is there any equivalent solution?

[gcusello · Accepted solution]

Hi @SplunkExplorer,

having questions like this, there's only one solution: search in the Splunkbase (apps.splunk.com), the repository of all Splunk apps: if there's an app to solve your need, surely it will be there!.

In your case, you could analyze (I never used them) these two apps:

• AssetDB (https://splunkbase.splunk.com/app/6115) a Splunk application that allows merging distinct data sources into an asset data base, without the need for Splunk Enterprise Securit;
• Splunk for Asset Discovery (https://splunkbase.splunk.com/app/662😞 it provides ping scans, port scans, operating system and port fingerprinting through the use of nmap in order to gain visibility into asset availability, port statistics, and even rogue device detection.

Ciao.

Giuseppe

[SplunkExplorer]

Thanks a lot Giuseppe, very usefull as usual.