https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424913#M5407 <P>We are trying to integrate the risk analysis framework in our incident response process. </P> <P>We have developed a library of correlation searches where the results produce multiple objects upon which we need to assign risk, e.g. src, dest, users. When we and the "| sendalert risk" components to the correlation searches, notable events no longer generate and risk scores are NOT applied. When we run the searches as ad-hoc, the risk scores are properly assigned and the results appear as expected.</P> <P>Can "| sendalert" not appear in a correlation search? The Risk Analysis Adaptive response action is not sufficient, as we can not dynamically set the risk tolerance, nor set risk against multiple objects with that action. </P> <P>e.g: <CODE>| eval risk_score=case(severity=="critical", 20, severity=="high", 15, severity=="medium", 10, severity=="low", 5</CODE></P> Thu, 23 Aug 2018 14:51:12 GMT panovattack 2018-08-23T14:51:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424913#M5407 <P>We are trying to integrate the risk analysis framework in our incident response process. </P> <P>We have developed a library of correlation searches where the results produce multiple objects upon which we need to assign risk, e.g. src, dest, users. When we and the "| sendalert risk" components to the correlation searches, notable events no longer generate and risk scores are NOT applied. When we run the searches as ad-hoc, the risk scores are properly assigned and the results appear as expected.</P> <P>Can "| sendalert" not appear in a correlation search? The Risk Analysis Adaptive response action is not sufficient, as we can not dynamically set the risk tolerance, nor set risk against multiple objects with that action. </P> <P>e.g: <CODE>| eval risk_score=case(severity=="critical", 20, severity=="high", 15, severity=="medium", 10, severity=="low", 5</CODE></P> Thu, 23 Aug 2018 14:51:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424913#M5407 panovattack 2018-08-23T14:51:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424914#M5408 <P>Just an update that we are waiting for a Splunk and ES upgrade to see if that fixes the issue. We'd like to be able to dynamically assign risk to multiple objects in a single correlation search. </P> Wed, 26 Sep 2018 18:24:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424914#M5408 panovattack 2018-09-26T18:24:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424915#M5409 <P>Still can't seem to figure it out after upgrade. Is there anyway to reliably assign risk to multiple objects from a correlation search or a saved search? Or is the limit one?</P> Tue, 13 Nov 2018 20:01:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424915#M5409 panovattack 2018-11-13T20:01:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424916#M5410 <P>See <A href="https://answers.splunk.com/answers/594711/splunk-enterprise-security-how-can-i-configure-a-c.html">https://answers.splunk.com/answers/594711/splunk-enterprise-security-how-can-i-configure-a-c.html</A> and <A href="http://dev.splunk.com/view/enterprise-security/SP-CAAAFBD">http://dev.splunk.com/view/enterprise-security/SP-CAAAFBD</A> to learn how to add risk to multiple objects.</P> Tue, 13 Nov 2018 20:38:00 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424916#M5410 smoir_splunk 2018-11-13T20:38:00Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424917#M5411 <P>The approach here does not seem to work when it comes to a correlation search. Multiple | sendalerts work in ad-hoc, but not when run as part of a correlation search. </P> Tue, 13 Nov 2018 21:14:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424917#M5411 panovattack 2018-11-13T21:14:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424918#M5412 <P>There are these examples in docs:<BR /> <A href="http://docs.splunk.com/Documentation/ES/5.2.0/User/RiskScoring">http://docs.splunk.com/Documentation/ES/5.2.0/User/RiskScoring</A><BR /> The <CODE>appendpipe</CODE> option is pretty good, but that said multiple <CODE>| sendalert</CODE>s should be supported as well - what version of ES are you on?</P> Tue, 04 Dec 2018 20:22:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424918#M5412 kchamplin_splun 2018-12-04T20:22:30Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424919#M5413 <P>I'm adding a score to several objects from one event from a saved search</P> <P>I do this</P> <PRE><CODE>| eval risk_object=mvappend(field_1."|system",field_2."|user",field_3."|user",field_4."|other") | eval risk_score=1 | mvexpand risk_object | eval x=split(risk_object, "|") | eval risk_object=mvindex(x, 0, 0), risk_object_type=mvindex(x,1,1) | fields - x </CODE></PRE> <P>and then sendalert at the end, so for each event, I get 4 events.</P> Tue, 01 Oct 2019 04:16:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Assign-Risk-in-Correlation-Search/m-p/424919#M5413 bowesmana 2019-10-01T04:16:06Z