Reveal Asset and Identity Activity with Splunk Asset and Risk Intelligence
Splunk Asset and Risk Intelligence (Splunk ARI) keeps track asset and identity discovery activity over time. This activity supports investigations into who had what asset and when, in addition to providing insights about asset changes over time and when they were first or last discovered. In this post, we highlight three use cases related to asset activity using Splunk ARI.
Attribute assets and identities to an IP address over time
Do you struggle to identify the individual or asset associated with an IP address at a specific point in time? The full discovery history in Splunk ARI allows this task to be performed instantly, saving hours of investigation time. The IP address to asset attribution view allows for an IP address to be investigated over a specific time range and the attributed assets or identities are displayed, along with the first and last detection window.
Identify ephemeral assets
Looking to quickly identify ephemeral assets that only appear for a short period of time? This type of activity can be associated with cloud assets or potentially anomalous assets on your network. The short lived asset and identities view in Splunk ARI identifies assets or identites that have only been detected for a specific period of time. This can help identify servers that may have been spun up and then shut down or rogue assets appearing on your network for short periods. Individual assets or identities can be drilled into for more details or investigation.
Find all newly discovered assets
Are you looking for a way to identify all the brand new assets on your network? Splunk ARI keeps a record of the first and last time any discovered asset has been detected, which allows for instant identification of newly discovered assets or identities. The first and last detections view reports on assets, identities, IPs, MACs, software or vulnerabilities first or last detected within a selected time period. This allows you to quickly report on new vulnerabilities affecting your assets over the past week or assets discovered in the past day.
More from this series:
- Discovering Assets and Identities with Splunk Asset and Risk Intelligence
- Investigating Assets and Identities with Splunk Asset and Risk Intelligence
- Finding Asset and Identity Risk with Splunk Asset and Risk Intelligence
Looking to find out more about Splunk Asset and Risk Intelligence? Contact us today for a demo and information about our Splunk ARI professional services.
© Discovered Intelligence Inc., 2025. Unauthorized use and/or duplication of this material without express and written permission from this site’s owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Discovered Intelligence, with appropriate and specific direction (i.e. a linked URL) to this original content.
