Splunk Enterprise Security

Enterprise Security: What are the extraction fields?

danielbb
Motivator

We wonder what the identity, Asset, File and URL Extraction fields are in the Notable set-up of the correlation search.

alt text

0 Karma

DavidHourani
Super Champion

Hi @danielbb 

File and URLThese correspond to the artifact creation flow on the investigation workbench. Instead of creating a file or URL artifact on the workbench by hand, you can specify which fields should be used to create artifacts automatically when you add a notable to the investigation workbench.

 

More details here:

https://docs.splunk.com/Documentation/ES/latest/Admin/Customizeinvestigations#Set_up_artifact_extrac...

couilda
Engager

If the Identity and Asset extraction features pull their information from the assets/identities lookup tables where does the File and URL extraction features pull their information from?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Those fields are where you tell the Notable where to find fields of each type. That is, the fields it should use for Identity information are 'src_user', and 'user'; the fields containing Asset information are 'src', 'dest', 'dvc', and 'orig_host'; and so on.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...