Splunk Asset and Risk Intelligence (Splunk ARI) discovers and reports on risks affecting assets and identities. This risk discovery is performed in real-time, ensuring that risks can be quickly addressed, helping to limit exposure and increase overall security posture. In this post, we highlight three use cases related to asset risk using Splunk ARI.
https://discoveredintelligence.com/wp-content/uploads/2025/04/ari_cybersecurity_frameworks.png8321402Discovered Intelligencehttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngDiscovered Intelligence2025-04-08 08:52:002025-06-10 17:17:50Finding Asset and Identity Risk with Splunk Asset and Risk Intelligence
Splunk Asset and Risk Intelligence (Splunk ARI) keeps track asset and identity discovery activity over time. This activity supports investigations into who had what asset and when, in addition to providing insights about asset changes over time and when they were first or last discovered. In this post, we highlight three use cases related to asset activity using Splunk ARI.
https://discoveredintelligence.com/wp-content/uploads/2025/03/ari_first_last_discovery.png8321402Discovered Intelligencehttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngDiscovered Intelligence2025-03-31 14:55:352025-05-28 16:27:31Reveal Asset and Identity Activity with Splunk Asset and Risk Intelligence
Splunk Asset and Risk Intelligence (Splunk ARI) has powerful asset and identity investigative capabilities. Investigations help to reveal the full asset record, cybersecurity control gaps and any associated activity. In this post, we highlight three use cases related to asset investigations using Splunk ARI.
https://discoveredintelligence.com/wp-content/uploads/2025/03/ari_subnet_investigation.png8321402Discovered Intelligencehttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngDiscovered Intelligence2025-03-25 13:44:082025-05-22 13:39:10Investigating Assets and Identities with Splunk Asset and Risk Intelligence
Splunk Asset and Risk Intelligence (Splunk ARI) continually discovers assets and identities. It does this using a patented approach that correlates data across mulitple sources in real-time. In this post, we highlight three use cases related to asset discovery using Splunk ARI.
https://discoveredintelligence.com/wp-content/uploads/2025/03/ari_cloud_discovery.png8321402Discovered Intelligencehttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngDiscovered Intelligence2025-03-20 14:09:012025-05-13 12:45:03Discovering Assets and Identities with Splunk Asset and Risk Intelligence
Data protection is a critical priority for any organization, especially when dealing with sensitive information like personal identifiable information (PII) and protected health information (PHI) data. Implementing robust protection mechanisms not only ensures compliance with regulations like the General Data Protection Regulation (GDPR) but also mitigates the risk of data breaches.
https://discoveredintelligence.com/wp-content/uploads/2025/01/field_filters.jpg7201000Carlos Moreno Buitragohttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngCarlos Moreno Buitrago2025-01-21 15:45:242025-01-21 15:47:43Field Filters 101: The Basics You Need to Know
With the recent release of Splunk Asset and Risk Intelligence (ARI), you may be looking for a better understanding of this great new solution and how you may get started. We have compiled a list of materials and resources you can use to help achieve this goal.
Read and Learn
Product overviews and briefs
If this is your first time reading up on Splunk Asset and Risk Intelligence, check these out first:
Get a quick look at the Splunk ARI interface with screen shots of the platform, along with information about its features and capabilities through the following blog posts:
It is often quicker, easier and more cost effective to get the Splunk ARI experts in. Our award winning consultants are highly trained on Splunk ARI and will ensure your continued success.
https://discoveredintelligence.com/wp-content/uploads/2018/10/gettingstarted.jpg286420Discovered Intelligencehttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngDiscovered Intelligence2024-12-02 15:02:342024-12-03 16:58:22Help Getting Started with Splunk Asset and Risk Intelligence (ARI)
Splunk Cloud Platform recently got an exciting new feature, it’s the new app export feature which provides cloud admins self-service capability to export app configuration files and associated app data.
We had a recent request to create a Splunk alert that runs hourly with a time range of midnight UTC of current date to current time. This sounds like an easy request, but when you look into it it’s a bit more complicated than it seems.
https://discoveredintelligence.com/wp-content/uploads/2024/11/savedsearch-2.png509854Darren Fullerhttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngDarren Fuller2024-11-15 13:38:362024-11-18 14:59:42Running a Splunk Search in a Different Time Zone
Integrating Splunk Enterprise Security (ES) with Splunk Security Orchestration, Automation and Response (SOAR) can significantly enhance your organization’s security operations. By automating alert handling and response processes, this integration streamlines security incident management and enables faster, more effective threat mitigation. Splunk SOAR empowers security teams to automate actions based on Splunk ES detections using assigned playbooks, enabling seamless incident resolution.
https://discoveredintelligence.com/wp-content/uploads/2024/08/es_soar.jpg5751000Heejoon Byunhttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngHeejoon Byun2024-09-30 18:01:202025-01-09 15:53:00Enhancing Security Operations: The Unified Integration of Splunk ES and SOAR
If you are like me when I started with Cribl, you will have plenty of Splunk knowledge but little to no Cribl experience. I had yet to take the training, had no JavaScript experience, and only had a basic understanding of Cribl, but I didn’t let that stop me and just dove in. Then I immediately struggled because of my lack of knowledge and spent countless hours Googling and asking questions. This post will list the information I wish I had possessed then, and hopefully make your first Cribl experience easier than mine.
Cribl Quick Reference Guide
If I could only have one item on my wish list, it would be to be aware of the Cribl Quick Reference Guide. This guide details basic stream concepts, performance tips, and built-in and commonly used functions.
Creating that first ingestion, I experienced many “how do I do this” moments and searched for hours for the answers, such as “How do I create a filter expression?” Generally, filters are JavaScript expressions essential to event breakers, routes, and pipelines. I was lost unless the filter was as simple as 'field' == 'value.' I didn’t know how to configure a filter to evaluate “starts with,” “ends with,” or “contains.” This knowledge was available in the Cribl Quick Reference Guide in the “Useful JS methods” section, which documents the most popular string, number and text Javascript methods.
Common Javascript Operators
Operator
Description
&&
Logical and
||
Logical or
!
Logical not
==
Equal – both values are equal – can be different types.
===
Strict equal – both values are equal and of the same type.
!=
Returns true if the operands are not equal.
Strict not equal (!==)
Returns true if the operands are of the same type but not equal or are of different kinds.
Greater than (>)
Returns true if the left operand is greater than the right operand.
Greater than or equal (>=)
Returns true if the left operand is greater than or equal to the right operand.
Less than (<)
Returns true if the left operand is less than the right operand.
Less than or equal (<=)
Returns true if the left operand is less than or equal to the right operand.
Regex
Cribl uses a different flavour of Regex. Cribl uses ECMAScript, while Splunk uses PCRE2. These are similar, but there are differences. Before I understood this, I spent many hours frustrated that my Regex code would work in Regex101 but fail in my pipeline.
Strptime
It’s almost identical to the version that Splunk uses, but there are a few differences. Most of my problems were when dealing with milliseconds. Cribl uses %L, while Splunk uses %3Q or %3N. Consult D3JS.org for more details on the strptime formatters.
JSON.parse(_raw)
When the parser function in a pipeline does not parse your JSON event, it may be because the JSON event is a string and not an object. Use an eval function with the Name as _raw and the Value Expression set to JSON.parse(_raw), which will convert the JSON to an object. A side benefit of JSON.parse(_raw) is that it will shrink the event’s size, so I generally include it in all my JSON pipelines.
Internal Fields
All Cribl source events include internal fields, which start with a double underscore and contain information Cribl maintains about the event. Cribl does not include internal fields when routing an event to a destination. For this reason, internal fields are ideal for temporary fields since you do not have to exclude them from the serialization of _raw. To show internal fields, click the … (Advanced Settings) menu in the Capture window and toggle Show Internal Fields to “On” to see all fields.
Event Breaker Filters for REST Collector or Amazon S3
Frequently, expressions such as “sourcetype=='aws:cloudwatchlogs:vpcflow‘” are used in an Event breaker filter, but sourcetype cannot be used in an Event Breaker for a REST Collector or an Amazon S3 Source. This is because this sourcetype field is set using the input’s Fields/Metadata section, and the Event Breaker is processed before the Field/Metadata section.
For a REST collector, use “__collectible.collectorId=='<rest collector id>'” internal field in your field expression, which the REST collector creates on execution.
One of Cribl Stream’s most valuable functions is the ability to effortlessly drop fields that contain null values. Within the parser function, you can populate the “Fields Filter Expression” with expressions like value !== null.
Some example expressions are:
Expression
Meaning
value !== null
Drop any null field
value !== null || value==’N/A’
Drop any field that is null or contains ‘N/A’
Once I obtained these knowledge nuggets, my Cribl Stream was more efficient. Hopefully, my pain will be your gain when you start your Cribl Stream journey.
https://discoveredintelligence.com/wp-content/uploads/2024/06/things_i_wish_i_knew_cribl.png532800Terry Mulliganhttps://discoveredintelligence.com/wp-content/uploads/2013/12/DI-Logo1-300x137.pngTerry Mulligan2024-07-08 13:00:002024-07-08 17:05:59Cribl Stream: Things I wish I knew before diving in