https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-multiple-risk-object-fields-on-ES-Risk-Analysis/m-p/471018#M7217 <P>Thanks, I think this will help me.</P> Tue, 29 Oct 2019 17:37:20 GMT alonsocaio 2019-10-29T17:37:20Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-multiple-risk-object-fields-on-ES-Risk-Analysis/m-p/471016#M7215 <P>When creating or editing a correlation search in Enterprise Security, Is there any way to use multiple fields on the Risk Analysis response action? </P> <P>As an example, I have a correlation search which I want to increase risk to both src and dest. I tried to separate this two fields using comma, but it does not seen to work.</P> Tue, 29 Oct 2019 11:24:44 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-multiple-risk-object-fields-on-ES-Risk-Analysis/m-p/471016#M7215 alonsocaio 2019-10-29T11:24:44Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-multiple-risk-object-fields-on-ES-Risk-Analysis/m-p/471017#M7216 <P>The UI does not support that.<BR /> You can review the docs on how to edit risk on another object by also doing it in your SPL search. Look at the section calling the sendalert command.</P> <P><A href="https://docs.splunk.com/Documentation/ES/5.3.1/User/RiskScoring">https://docs.splunk.com/Documentation/ES/5.3.1/User/RiskScoring</A></P> Tue, 29 Oct 2019 17:09:45 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-multiple-risk-object-fields-on-ES-Risk-Analysis/m-p/471017#M7216 starcher 2019-10-29T17:09:45Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-multiple-risk-object-fields-on-ES-Risk-Analysis/m-p/471018#M7217 <P>Thanks, I think this will help me.</P> Tue, 29 Oct 2019 17:37:20 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-use-multiple-risk-object-fields-on-ES-Risk-Analysis/m-p/471018#M7217 alonsocaio 2019-10-29T17:37:20Z