Configure a new asset or identity list in Splunk Enterprise Security

Configure a new asset or identity lookup in Splunk Enterprise Security. This multistep process adds the lookup in Splunk Enterprise Security and defines the lookup for the merge process.

Prerequisite Format an asset or identity list as a lookup in Splunk Enterprise Security. IPv6 addresses are not supported.

Steps

1. Add the new lookup table file
2. Set permissions on the lookup table file to share it with Splunk Enterprise Security
3. Add a new lookup definition
4. Set permissions on the lookup definition to share it with Splunk Enterprise Security
5. Add an input stanza for the lookup source
6. (Optional) Force a merge

Add the new lookup table file

1. From the Splunk menu bar, select Settings > Lookups > Lookup table files.
2. Click New.
3. Select a Destination App of SA-IdentityManagement.
4. Select the lookup file to upload.
5. Type the Destination filename that the lookup table file should have on the search head. The name should include the filename extension.
   For example, network_assets_from_CMDB.csv
6. Click Save to save the lookup table file and return to the list of lookup table files.

Set permissions on the lookup table file to share it with Splunk Enterprise Security

1. From Lookup table files, locate the new lookup table file and select Permissions.
2. Set Object should appear in to All apps.
3. Set Read access for Everyone.
4. Set Write access for admin or other roles.
5. Click Save.

Add a new lookup definition

1. From the Splunk menu bar, select Settings > Lookups > Lookup definitions.
2. Click New.
3. Select a Destination App of SA-IdentityManagement.
4. Type a name for the lookup source. This name must match the name defined later in the input stanza definition on the Identity Management dashboard.
   For example, network_assets_from_CMDB.
5. Select a Type of File based.
6. Select the lookup table file created.
   For example, select network_assets_from_CMDB.csv.
7. Click Save.

Set permissions on the lookup definition to share it with Splunk Enterprise Security

1. From Lookup definitions, locate the new lookup definition and select Permissions.
2. Set Object should appear in to All apps.
3. Set Read access for Everyone.
4. Set Write access for admin or other roles.
5. Click Save.

Add an input stanza for the lookup source

1. Return to Splunk Enterprise Security.
2. From the Splunk ES menu bar, select Configure > Data Enrichment > Identity Management.
3. Click New.
4. Type the name of the lookup.
   For example, network_assets_from_CMDB.
5. Type a Category to describe the new asset or identity list.
   For example, CMDB_network_assets.
6. Type a Description of the contents of the list.
   For example, network assets from the CMDB.
7. Type asset or identity to define the type of list.
8. Type a Source that refers to the lookup definition name.
   For example, lookup://network_assets_from_CMDB.
9. Click Save.
10. Wait five minutes. Splunk Enterprise Security merges the asset and identity lists every five minutes with a saved search. For an explanation of this process, see How Splunk Enterprise Security processes and merges asset and identity data.

Force a merge

You can also run the primary saved searches directly to force a merge immediately without waiting the five minutes for the scheduled search to run.

1. Open the Search page.
2. Run the primary saved searches.

| from savedsearch:"Identity - Asset String Matches - Lookup Gen"

| from savedsearch:"Identity - Asset CIDR Matches - Lookup Gen"

| from savedsearch:"Identity - Identity Matches - Lookup Gen"

Next step

Verify that your asset and identity data was added to Splunk Enterprise Security