Asset inventory
Business context for assets and identities: Enterprise Security's asset / identity lookups or CSV import; investigations, triage and reports pick up owner and criticality automatically.
"Affected assets" in an investigation, cluster subjects in triage and top subjects in reports all pass through one resolver: host / IP / user → asset name, business unit, owner, criticality. This page manages the data behind it. Available in every edition.
Sources
| Source | Notes |
|---|---|
| Splunk ES | With ES installed, asset_lookup_by_str / identity_lookup_expanded are read directly, not copied |
| CSV | Upload an asset table (host / ip / owner / bu / criticality …) and an identity table (user / name / dept / role …), stored in KV copilot_assets / copilot_identities; column names are matched loosely |
The "Status" card shows which of the three sources are available; the resolver tries the ES lookups first, then CSV.
The page
- Coverage: the subjects of the last 200 alerts are resolved and the hit rate shown; a low number means missing hosts or IP ranges.
- Assets / Identities tabs: paged browsing, multi-term AND search; the agentic
lookup_assettool reads the same data.
Import
Admins upload CSV; same host / user overwrites, nothing is deleted. Clearing a table is done from its tab.
Runbooks
The knowledge base: upload runbooks and SOPs as retrieval context, sync this instance's Splunk objects, the solutions library and correction rules, keyword or semantic retrieval.
Baseline checks
Host-configuration baseline and OS end-of-life compliance patrol: a rule library, manual or daily runs, results and trends per host. Data from the CIM Endpoint / Change data models.