During incident response on a city workstation, the analyst has src but needs the asset owner, priority, and business unit from the municipal asset table — the same context Asset and Identity would add in Enterprise Security. Which SPL command should they use?

lookup reads a CSV or KV asset table and attaches output fields when a key such as src matches, which is how an analyst mirrors Enterprise Security Asset and Identity enrichment during ad-hoc incident response on a city workstation. Owner, priority, and business unit are attributes of the municipal asset inventory, not properties encoded inside the IP string, so the correct command is lookup against that civic table. The enriched event then carries the same context ES would add automatically when A&I is healthy. rex cannot invent true owner, priority, or bunit from octets in an address; regex extracts text, it does not consult the asset catalog. makeresults creates synthetic fields without reading the asset table, so any owner it invents is fiction rather than civic inventory truth. transaction glues events that share keys over time; it does not attach asset-table columns to src. Exam caveat: the lookup key and output field names must align with the table definition—src versus dest, host versus ip—or enrichment silently misses even when the asset exists. Operational check: lookup a known city workstation IP from the asset CSV, confirm owner, priority, and bunit populate, and compare those values to what Asset and Identity shows for the same host in Enterprise Security.