Splunk Asset and Risk Intelligence

Splunk Asset and Risk Intelligence is a platform that provides continuous asset discovery and inventory management across IT environments. The solution correlates data from multiple sources including network, endpoint, cloud, and scanning tools to maintain a unified inventory of assets and identities. The platform discovers and monitors endpoints, servers, users, cloud resources, and OT/IoT devices. It enriches asset records by correlating data from vulnerability and software scanning tools to provide information about software versions and vulnerabilities present on systems. The solution integrates with Splunk Enterprise Security to continuously update the Assets & Identities framework and provide asset context for notable event enrichment. It offers bi-directional integration with ServiceNow CMDB to synchronize asset records and identify unmanaged devices. The platform includes compliance monitoring capabilities with out-of-the-box and customizable dashboards for metrics such as laptop encryption, vulnerability scanning coverage, application enforcement, and malware protection. Security teams can use the asset and identity context to accelerate investigations by identifying which users are associated with specific assets and when. The solution aims to reduce investigation time by providing asset context within the Splunk platform, eliminating the need to pivot to external systems during security investigations.