CM-8 on Splunk

What this finds

A device generated authentication or platform telemetry, has been doing so for longer than the registration grace period, and does not appear in the supplied asset inventory.

The requirement

The organization must develop and maintain an inventory of system components that accurately reflects the system, is at the level of granularity deemed necessary for tracking and reporting, and is reviewed and updated at an organization-defined frequency.

NIST SP 800-53 Rev. 5 — CM-8 (System Component Inventory).

NIST requires the inventory to be accurate. It does not say what counts as a component, how quickly a new device must be registered, or which populations are exempt. This pack finds devices that are demonstrably active — they authenticated or generated telemetry — and are not in the inventory you supplied. The registration grace period and the exempt populations are yours to define.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

• 3.R — Prohibit connection of unauthorized devices
  The goal is preventing unauthorized devices from connecting; the pack finds devices demonstrably active in the estate that the inventory does not list.
• 2.A — Manage organizational assets
  Managing organizational assets requires the inventory to be accurate. This pack tests that accuracy directly, from the opposite direction: it finds what the inventory is missing.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

The query

Published as cm-8-unmanaged-devices.splunk.spl. Reads index=identity sourcetype=authentication:events, asset_inventory.csv (lookup). Requires: Search access to the identity index; Read on the lookup.

Before this returns anything, index=identity sourcetype=authentication:events has to be reaching Splunk Enterprise / Enterprise Security, and asset_inventory.csv (lookup) has to be landed there. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

index=identity sourcetype=authentication:events
| eval device_key=lower(dest)
| stats min(_time) AS first_seen, max(_time) AS last_seen, dc(user) AS distinct_users
        BY device_key
| search NOT
    [ | inputlookup asset_inventory.csv
      | eval device_key=lower(asset_id)
      | fields device_key ]
| where first_seen < relative_time(now(),"-7d")
| eval days_unregistered=round((now()-first_seen)/86400)
| convert ctime(first_seen) ctime(last_seen)
| table device_key, first_seen, last_seen, distinct_users, days_unregistered
| sort - days_unregistered

Open this pack on Splunk to adjust the settings and download it →

The interactive version opens on Splunk — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Registration grace period (days) (default 7)

A device is only reported once it has been active this many days without appearing in the lookup.

Exclude specific devices (optional)

Paste device names to exempt, one per line.

What this query returned when it was run

Executed against Splunk Enterprise 10.4.2 on 2026-08-07 against purpose-built test data. The software examined 33 records and returned 1 result in 0.10400000000000001 seconds.

Test data, not a real organization. It shows the query executes and returns the intended shape of result.

Running it continuously

Correlation search → notable event

Search type:      Correlation search (Enterprise Security)
Cron schedule:    0 */12 * * *   (twice daily)
Time range:       -14d to now
Trigger:          Number of results > 0
Alert action:     Create notable event
Urgency:          Medium
Security domain:  Network
Drill-down:       index=identity dest="$device_key$"
Throttling:       Suppress 7d on device_key

Reads the same vendor-neutral authentication:events sourcetype as AC-7, so an environment that forwarded its authentication source for one pack gets this one with no further work.

Before you act on a result

• Is the inventory export complete and current, or does it cover only part of the estate?
• Does the device use a different identifier in telemetry than in the inventory — a hostname against an asset tag, for example?
• Is this an exempt population, such as a guest network or an ephemeral build agent?
• Was the device registered under a name that has since changed?
• If it is genuinely unmanaged, who owns it and what does it have access to?

Common questions

How do I check for device active in the estate but absent from the inventory in Splunk?

Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads index=identity sourcetype=authentication:events, asset_inventory.csv (lookup) and reports: A device generated authentication or platform telemetry, has been doing so for longer than the registration grace period, and does not appear in the supplied asset inventory.

What permissions are needed to run this Splunk query?

Search access to the identity index; Read on the lookup.

What evidence does CM-8 need that Splunk cannot produce?

Asset inventory (asset_inventory.csv). Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against. At minimum it must carry: asset_id, environment, criticality.

Does a result from this query mean the control has failed?

An unregistered device is not evidence of an intrusion, and this is the pack most likely to report a records problem rather than a security one. Identifier mismatches between telemetry and inventory produce the same result as a genuinely unknown device, which is why the review tier is automated-with-review rather than automated.

The same control on other platforms

• CM-8 on Microsoft Sentinel — KQL
• CM-8 on AWS — SQL (Athena) + Lambda
• All platforms for CM-8