Which fields are used for the identity comparison in Splunk ES?

[jacqu3sy]

Hi,

Within Splunk Enterprise Security, when the urgency of a notable event is calculated, the priority of the identity is used alongside the Severity of the savedsearch. This I follow and understand.

However, which fields are used for the identity comparison? The identity lookup contains headers identity, nick, first, last, email among others.

Which of these fields is used to compare with the Splunk event? And then, which field pulled back via the savedsearch in Splunk is used for the comparison? user, account, login etc

Splunk docs do not appear to provide the answer via either;

https://docs.splunk.com/Documentation/ES/5.2.2/User/Howurgencyisassigned#Modify_the_urgency_lookup_d...

OR

https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Addassetandidentitydata

Thanks.

[lakshman239]

The 2 key fields which help determine the severity/priority and correlate to events is the 'user_priority' and 'user_category'

You can run |makeresults | eval user="jacqu3sy" |get_identity4events(user) to link back to Identity data in your deployment and it will show all user_* fields.

[squidbarn]

Be sure to surround the macro in back-ticks: 

| makeresults | eval user="jacqu3sy" | `get_identity4events(user)`

[jacqu3sy]

That's a really useful query, many thanks.

[harsmarvania57 · Accepted solution]

Hi,

While looking at SA-IdentityManagement add-on which ships with Enterprise Security, I can see that src_user and user fields from events are mapping with Identity Lookup automatically and it will provide fields like src_user_first, user_first etc.

EDIT: From identity_lookup_expanded Lookup definition, splunk is mapping key field from lookup with src_user and user fields from actual events

[jacqu3sy]

Hi, thanks for that. But where are you seeing this and how can I view it?

And if src_user and user are the fields in question, which field in identity lookup are they mapping to; identitiy, nick, first, last etc?

[harsmarvania57]

Go to Settings -> Lookups -> Automatic Lookups and Select apps as SA-IDentityManagement and you will able to see default : LOOKUP-zy-identity_lookup_expanded-src_user and default : LOOKUP-zy-identity_lookup_expanded-user automatic lookup which is mapping key field from identity_lookup_expanded lookup definition with src_user and user fields from actual events

[jacqu3sy]

Really helpful. Thanks.