Lookups and Identity Management

Question 1

What is an example of an ES asset?

Answer 1

• Server
• Network Devices
• Endpoints
• Databases
• Applications

Question 2

Which columns in the Assets lookup are used to identify an asset in an event?

Answer 2

ip, mac, dns, nt_host

Question 3

How does Identity Matching work

Answer 3

• ES takes a value from an event’s user, src_user, email, or src_email field and tries to match it to a value in the identities lookup in the following order
  1. Identity column (exact match)
  2.Email (exact match)
  3. Email (alias without domain)
  4. Any (disabled by default)