topic Re: Risk isn't showing up in the Edit Correlation Search in Splunk Enterprise Security

Risk isn't showing up in the Edit Correlation Search?

spctravis — Fri, 16 Sep 2022 14:48:08 GMT

I have an app with my alerts. I have risk enabled and it's working however risk isn't showing up in the Edit Correlation Search menu. Is there a setting in a .conf file I am missing? I looked into alert_actions.conf but don't see any other rule with that linking to it. Below is my risk setting for one of my rules:

action.risk = 1
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 14}]
action.risk.param._risk_message = Wsmprovhost.exe spawned a LOLBAS process on $dest$.
action.risk.param._risk_score = 0
action.risk.param.verbose = 0

Re: Risk isn't showing up in the Edit Correlation Search

hettervik — Fri, 16 Sep 2022 13:49:56 GMT

Do you want a correlation search to add risk score to an object? If so, you have to edit the correlation search in Splunk ES, and then add a "Risk Analysis" response action, all the way at the bottom of the edit page. There you can add risk scores to users and systems from you correlation search.

Re: Risk isn't showing up in the Edit Correlation Search

spctravis — Tue, 20 Sep 2022 13:24:30 GMT

I want to be able to add the risk using .conf files not go through the gui. 800 plus rules is too many to one by one.