https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-what-makes-a-correlation-search-a/m-p/451734#M6284 <P>Hi, <BR /> According to the ES tutorial... it's not just a search, but a search that then does one of the following: <BR /> "A correlation search is a type of search that evaluates events from one or more data sources for defined patterns. When the search finds a pattern, it creates a notable event, adjusts a risk score, or performs an adaptive response action. A correlation search is a saved search with extended capabilities making it easier to create, edit, and use searches for security use cases."<BR /> <A href="https://docs.splunk.com/Documentation/ES/5.3.1/Tutorials/CorrelationSearch">https://docs.splunk.com/Documentation/ES/5.3.1/Tutorials/CorrelationSearch</A></P> <P>So since it creates a notable event, it's a correlation search. </P> Thu, 15 Aug 2019 19:16:24 GMT lkutch_splunk 2019-08-15T19:16:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-what-makes-a-correlation-search-a/m-p/451733#M6283 <P>I'm looking at a sample correlation search called <STRONG>Abnormally High Number of HTTP Method Events By Src</STRONG> -</P> <PRE><CODE>| tstats `summariesonly` count as web_event_count from datamodel=Web.Web by Web.src, Web.http_method | `drop_dm_object_name("Web")` | xswhere web_event_count FROM count_by_http_method_by_src_1d in web by http_method is above high </CODE></PRE> <P>What makes it a correlation search?</P> Thu, 15 Aug 2019 19:07:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-what-makes-a-correlation-search-a/m-p/451733#M6283 danielbb 2019-08-15T19:07:48Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-what-makes-a-correlation-search-a/m-p/451734#M6284 <P>Hi, <BR /> According to the ES tutorial... it's not just a search, but a search that then does one of the following: <BR /> "A correlation search is a type of search that evaluates events from one or more data sources for defined patterns. When the search finds a pattern, it creates a notable event, adjusts a risk score, or performs an adaptive response action. A correlation search is a saved search with extended capabilities making it easier to create, edit, and use searches for security use cases."<BR /> <A href="https://docs.splunk.com/Documentation/ES/5.3.1/Tutorials/CorrelationSearch">https://docs.splunk.com/Documentation/ES/5.3.1/Tutorials/CorrelationSearch</A></P> <P>So since it creates a notable event, it's a correlation search. </P> Thu, 15 Aug 2019 19:16:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-what-makes-a-correlation-search-a/m-p/451734#M6284 lkutch_splunk 2019-08-15T19:16:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-what-makes-a-correlation-search-a/m-p/451735#M6285 <P>Ok, makes sense.</P> <P>This particular search has the following Adaptive Response Actions -</P> <P>1) Risk Analysis<BR /> 2) Notable</P> Thu, 15 Aug 2019 19:23:11 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-what-makes-a-correlation-search-a/m-p/451735#M6285 danielbb 2019-08-15T19:23:11Z