topic Re: Risk Score, Risk Event and Risk Object is not showing in the notable event. in Splunk Enterprise Security

Why aren't Risk Score, Risk Event and Risk Object showing in the notable event?

syazwani — Thu, 15 Sep 2022 14:31:00 GMT

Hi peeps,

We were fine tuning the Notable Event, and there were fields that were not showing any values. Those fields are the Risk Score, Risk Event and Risk Object. We have configure the value under the Risk Analysis Tab.

Please assist us on this. Thank you.

Re: Risk Score, Risk Event and Risk Object is not showing in the notable event.

hettervik — Thu, 15 Sep 2022 11:14:46 GMT

Hi. Yes, I see the confusion. The fields you add under the response action "Risk Analysis" are not added the the notable event itself (index=notable), they are added to the risk event (index=risk). These risk events are used for Risk-Based Alerting, among other things.

If you want the "user" and "app" fields to be added to the notable event, just make sure these fields are present in the final output of your correlation search, and you shoud see them in the incident.

Re: Why aren't Risk Score, Risk Event and Risk Object showing in the notable event?

travis_lelle — Fri, 22 Sep 2023 15:11:36 GMT

Have you found a solution for this? I'm experiencing the same thing, and I made sure that the fields we provided in the Risk Analysis Adaptive response Action is a valid field that is being presented in the correlation search results. In fact, I'm using the same fields as variables in the title of the notable event. But nothing is populating in Incident review for Risk Score, Risk Event, and Risk Object.

Re: Why aren't Risk Score, Risk Event and Risk Object showing in the notable event?

roberto_baggio — Thu, 08 Feb 2024 13:14:09 GMT

Hey so did you find the solution? We stacked with the same issue and seams no one knows how to fix it.