During incident response on a city workstation, the analyst has src but needs the asset owner, priority, and business unit from the municipal asset table — the same context Asset and Identity would add in Enterprise Security. Which SPL command should they use?
Select an answer to reveal the explanation.
Short Explanation
Asset owner and priority do not live inside the IP address — they live in the city's asset list. lookup is the join that stamps owner, priority, and business unit onto src, the same enrichment Asset and Identity applies automatically in ES.
Full Explanation
lookup reads a table (CSV or KV) and adds output fields when a key such as src matches. That is how an analyst mirrors Asset and Identity enrichment during an ad-hoc IR search on a city workstation. rex cannot derive true owner or business unit from an IP string. makeresults does not consult the asset table, and transaction groups events in time rather than attaching civic asset context.