Perform identity resolution to associate data with entities in behavioral analytics service

Behavioral analytics service performs identity resolution on all events to associate them with an originating user and device. Behavioral analytics service builds a database of identity relationships using the following data:

• Dynamic data sources, such as DHCP, DNS, VPN, and AD event data.
  • DHCP data is used to resolve IP addresses to MAC addresses.
  • DNS data is used to resolve IP addresses to domain names.
  • VPN data is used to resolve IP addresses to users.
• Static data sources, such as assets and identities data from Splunk Enterprise Security (ES) on Splunk Cloud Platform. See Import assets and identities data from Splunk ES on Splunk Cloud Platform into behavioral analytics service.

Using the identity database, identity resolution is applied to all events in an attempt to associate each event to a specific device, such as a single IP address, MAC address, or hostname, or a user. Behavioral analytics service also generates a unique ID for each device and user as part of identity resolution, and enriches the raw event by assigning the device ID to the device_id field and the user ID to the user_id field. See Enrich events using identity resolution and assets and identities data in behavioral analytics service.

How behavioral analytics service handles out-of-order events

Events from the multitude of devices in your network arrive in behavioral analytics service at various times. There can be cases where an event from a network device arrives earlier than the DHCP event that is used to properly resolve the network event to a specific user or device. Behavioral analytics service can detect this difference and apply a slight delay before performing identity resolution on the network event.

Behavioral analytics service doesn't update existing anomalies using identity resolution

Once an anomaly is generated, the information associated with the anomaly is not updated. For example, there may be anomaly showing an IP address, but later on some DNS data arrives so that the IP address can be resolved to a domain name. The existing anomaly is not updated to use the domain name as it is unknown if the IP address was associated to the domain name at the time of detection. Updates to assets and identities data ingested from Splunk ES on Splunk Cloud Platform are reflected in the entities.