Endpoint Information Data Source

Purpose

When users ask about endpoint inventory, computer details, hardware, operating system, battery, BIOS, network adapters, installed memory, Secure Boot, TPM, or other endpoint configuration, the primary data source is getIndexConfidentialData.

Do not assume the data is stored in generic Splunk indexes or search index=* unless specifically instructed.

Data Source

Splunk source

source="monitor.endpoint.info"

The events in this source contain the complete endpoint inventory as JSON, including information such as:

• Computer name
• Endpoint identifier
• Lookup key
• Operating system and version
• Hardware manufacturer and model
• CPU information
• Memory
• BIOS
• Battery information
• Power settings
• Secure Boot status
• TPM
• Network interfaces
• Display devices
• Sound devices
• Video devices
• Physical memory
• Page file
• Browser inventory
• Virtual machine information
• Geographic location
• Public/Internal IP addresses
• Active user
• Registration information
• Power plan
• Endpoint agent version

Example fields include hostname, lookup_key, manufacturer, model, os, cpu_model, memory_mb, battery_*, bios, network_interfaces, secureboot, power_settings, version, and many additional nested JSON properties.

Summary Data

For most endpoint lookups, do not search the raw events first.

Instead, use the KV Store lookup:

ux_nodes_lookup

This lookup contains a summarized view of endpoint information and should be the preferred source for:

• Endpoint inventory
• Host information
• Endpoint status
• Last registration
• Operating system
• Manufacturer
• Model
• Agent version
• Lookup key
• Common endpoint attributes

Only query the raw source="monitor.endpoint.info" data when:

• Detailed endpoint properties are required.
• Nested JSON objects are needed.
• A field is not present in the KV Store.
• Troubleshooting data inconsistencies.

Agent Rules

1. Prefer ux_nodes_lookup for endpoint inventory questions.
2. Use source="monitor.endpoint.info" only when detailed endpoint information is required.
3. Never assume endpoint information exists in index=main.
4. Never invent index names.
5. If an index is unknown, use the getIndexConfidentialData tool rather than guessing.
6. Preserve nested JSON structures when querying detailed endpoint information.
7. When searching raw endpoint data, filter on identifying fields such as:
   • lookup_key
   • hostname
   • machine_uuid
   • identifying_number
   • hostname_encrypted
8. Prefer the KV Store over raw event searches whenever it contains the required information.

Typical User Questions

User asks	Preferred source
List all endpoints	ux_nodes_lookup
Find endpoint by hostname	ux_nodes_lookup
Find endpoint by lookup key	ux_nodes_lookup
Show battery wear level	source="monitor.endpoint.info"
Show BIOS details	source="monitor.endpoint.info"
Show power settings	source="monitor.endpoint.info"
Show network adapters	source="monitor.endpoint.info"
Show Secure Boot information	source="monitor.endpoint.info"
Show TPM details	source="monitor.endpoint.info"

Response Strategy

Before generating SPL, determine whether the requested information is available from the endpoint summary.

• If yes, use ux_nodes_lookup.
• If no, query getIndexConfidentialData with source="monitor.endpoint.info".
• Do not tell the user "no data found" until both sources have been considered.