Splunk Enterprise Security

Splunk Enterprise Security: How to associate business software to an asset?

edhealea
Path Finder

I have a .csv which contains a list of business applications, the app owner, the server(hostname or same as nt_host) the app is installed on and the software's risk rating.
What I need to do is take the application(s) and the app owner(s) and associate them to the nt_host in our assets.
I currently have the file installed as a lookup but not sure how to proceed.

0 Karma

Richfez
SplunkTrust
SplunkTrust

The regular Splunk tutorial may or may not have an example (I don't know for sure), but here's one that you can follow to get a reasonable example of how to do these things.

A close reading of the docs for lookup may also suggest at least things to try.

One thing you might need to do is make sure you have a field to join them up on - nt_host is fine, but it would have to be on both sides (not necessarily with the same name - just the contents.)

... | lookup TheNameOfMyLookup FieldInLookup1 AS FieldNameInEvent1 OUTPUT appowner AS MyNewAppOwnerName application AS MyNewApplicationName

It's just a sample, but hopefully this gets you started.

Happy Splunking,
Rich

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...