Splunk Enterprise Security

Splunk Enterprise Security - How do you add asset fields in new search automatically?

Engager

Hi,

I'm working on adding new data in CIM and putting tags in Communication and network with required fields. Of course, we have proper assets and other data types pull the info well.

I also expect to view asset fields when searching for new data but none are shown. Is there any other way to have assets fields automatically?

Tags: network and communication
Fields:
src_ip
dest_ip
dest_port
src_port
..,

Thanks in advance.

0 Karma

SplunkTrust
SplunkTrust

The asset autolookups in ES occur on dest, src, dvc etc not on dest_ip. Make sure you coalesce it field alias your fields like src_ip, src_host into src.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!