count_of_assets_by_category.yml

name: Count of assets by category
id: dcfd6b40-42f9-469d-a433-2e53f7489ff9
version: 1
date: '2017-09-13'
author: Bhavin Patel, Splunk
type: Baseline
datamodel: []
description: This search shows you every asset category you have and the assets that
  belong to those categories.
search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)
  by category | sort -count'
how_to_implement: To successfully implement this search you must first leverage the
  Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv
  file which should then be mapped to the Identity_Management data model. The Identity_Management
  data model will contain a list of known authorized company assets. Ensure that all
  inventoried systems are constantly vetted and updated.
known_false_positives: none
references: []
tags:
  analytic_story:
  - Asset Tracking
  detections:
  - Detect Unauthorized Assets by MAC address
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Identity_Management.All_Assets
  - category
  security_domain: endpoint