Harnessing the power of Splunk Asset and Risk Intelligence to accelerate investigations

Dimitri McKay, Security Strategist at Splunk with a background in incident investigation and penetration testing, demos Asset and Risk Intelligence (ARI), a feature that runs on top of existing Splunk data to build a real-time inventory of assets and identities. He opens by arguing that CMDBs consistently fail because they depend on people manually keeping records current, and describes finding customers whose real asset counts differed sharply from what their CMDB reported. ARI needs no new data sources: it parses existing logs from DHCP, EDR tools like CrowdStrike, and forwarders into asset records, tagging device type, location, software, vulnerabilities, and IP history, and standing up in about two hours. He walks through use cases: pivoting from a host, IP, or user to everything known about it during an investigation; spotting unmanaged or unprotected assets; tracking cloud assets across multiple providers; compliance reporting against NIST, ISO, PCI, and HIPAA; and feeding risk-based alerting. Audience questions cover gathering data from remote or retail sites via existing local scanners, and the tool's query performance and confidence-weighted approach to prioritizing data sources like DHCP over slower feeds.