Splunk Enterprise Security

Whats the best way to verify Identity and Asset framework is properly setup in ES ?

damode
Motivator
0 Karma

Jhunter
Explorer

Another (slightly crude) way is on your fields side bar for sourcetypes that have asset/identity fields (such as user) extracted, you should see the user_ fields with each user header (example: user_email, user_nick, user_first). 

0 Karma

Jhunter
Explorer

For assets I believe these are the src_ fields that match the asset header such as

src_should_update

src_is_expected

0 Karma

nickhills
Ultra Champion

The easiest way to confirm that you have identities and assets being collected and presented correctly is with the following two searches.

 

 

|`identities`
and
|`assets`

 

 

If those commands produce complete & well formatted output, then it should be working. 

If my comment helps, please give it a thumbs up!

lkutch_splunk
Splunk Employee
Splunk Employee

I agree with nickhillscpl & it's one of the options listed in the doc: 

https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Verifyassetandidentitydata

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...