Asset inventory
Business context for assets and identities. Sources are Enterprise Security's asset and identity lookups or CSV import; investigations, triage and reports pick up owner and criticality automatically.
Affected assets in an investigation, cluster subjects in triage and top subjects in reports all pass through one resolver: host, IP or user to asset name, business unit, owner and criticality. This page manages the data behind it. Available in every edition.
Sources
| Source | Notes |
|---|---|
| Splunk ES | With ES installed, asset_lookup_by_str and identity_lookup_expanded are read directly, not copied |
| CSV | Upload an asset table (host, ip, owner, bu, criticality and other columns) and an identity table (user, name, dept, role and others), stored in KV copilot_assets and copilot_identities. Column names are matched loosely |
The Status card shows which sources are available. The resolver tries the ES lookups first, then CSV.
Page
| Block | Notes |
|---|---|
| Coverage | The subjects of the last 200 alerts are resolved and the hit rate shown. A low number means missing hosts or IP ranges |
| Assets and Identities tabs | Paged browsing, multi-term AND search. The agentic lookup_asset tool reads the same data |
Import
Admins upload CSV. A same-named host or user is overwritten; nothing is deleted. Clearing a table is done from its tab.
Runbooks
The knowledge base. Upload runbooks and SOPs as retrieval context, sync this instance's Splunk objects, the solutions library and correction rules, keyword or semantic retrieval.
Baseline checks
Host-configuration baseline and OS end-of-life compliance patrol. A rule library, manual or daily runs, results and trends per host. Data from the CIM Endpoint and Change data models.