Splunk® Add-on for Asset and Risk Intelligence
Install and Manage the Splunk Add-on for Asset and Risk Intelligence
- Documentation
- Splunk® Add-on for Asset and Risk Intelligence
- Install and Manage the Splunk Add-on for Asset and Risk Intelligence
- Data collected by the Splunk Add-on for Asset and Risk Intelligence
Introduction
- Get started with the Splunk Add-on for Asset and Risk Intelligence
Install and configure
- System requirements and product compatibility for the Splunk Add-on for Asset and Risk Intelligence
- Install the Splunk Add-on for Asset and Risk Intelligence
Manage
- Known data sources available for the Splunk Add-on for Asset and Risk Intelligence
- Data collected by the Splunk Add-on for Asset and Risk Intelligence
Release notes
- Known issues for the Splunk Add-on for Asset and Risk Intelligence
- Fixed issues for the Splunk Add-on for Asset and Risk Intelligence
- Stuck with Splunk ES Upgrade
Read more...
The Splunk Add-on for Asset and Risk Intelligence collects asset-relevant information using scripted inputs. The inputs run at different frequencies. For example, the add-on collects network data more frequently than system data because system data changes less frequently.
The following table describes the types of data collected by the Splunk Add-on for Asset and Risk Intelligence:
| Type | Description | Data source fields | Sourcetype |
|---|---|---|---|
| System | Includes system information from assets. The fields collected depend on the operating system. | nt_host, os, os_version, os_build, os_vendor, os_configuration, os_build_type, os_install_date, windows_directory, system_directory, system_boot_time, boot_device, registered_user, virtual_mem, processor, cpu_cores, cpu_mhz, domain, mem, system_type, available_memory, available_virtual_memory, serial, vendor, bios_version, product, model_identifier, chip, system_firmware_version, os_loader_version, hardware_uuid, provisioning_udid, kernel_version, boot_volume, boot_mode, secure_virtual_memory, system_integrity_protection, time_since_boot | ari_ta:asset |
| Network | Includes network information from assets including IP addresses and MAC addresses | mac, ip, ip_translated | ari_ta:asset |
| User | Includes information about the last user associated with the asset | user_id, account_active, last_logon, session | ari_ta:asset |
| Encryption | Includes encryption data from Windows (BitLocker) and Mac (Filevault) | bitLocker_version, encryption_method, volume_label, volume_letter, volume_type, drive_type, size, protection_status, conversion_status, fde_encrypted=1 fde_version, activation_lock_status | ari_ta:asset |
| Software | Includes the software vendor, product, and version. Not currently available for Linux. | install_date, install_location, ari_software_product, ari_software_vendor, ari_software_version | ari_ta:software |
Last modified on 05 August, 2024
| Known data sources available for the Splunk Add-on for Asset and Risk Intelligence | Known issues for the Splunk Add-on for Asset and Risk Intelligence |
This documentation applies to the following versions of Splunk® Add-on for Asset and Risk Intelligence: 1.0.0
Download manual
Download this page
You must be logged into splunk.com in order to post comments. Log in now.
Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.
We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here »
Closing this box indicates that you accept our Cookie Policy.
