topic Re: How to ignore unknown objects in Risk adaptive response? in Splunk Enterprise Security

How to ignore unknown objects in Risk adaptive response?

phil_wong — Sat, 05 Jun 2021 08:56:59 GMT

Hi,

There're some incidents hit my threat intelligence IP, e.g. dest. That's why Threat Activity notable event is triggered which is good to see.

However, my concern is it would at the same time multiple the score of "unknown" user and "unknown" src/dest.

How can I filter these noise effectively, so not so many false alert introduced by "unknown" user or IP?

Re: How to ignore unknown objects in Risk adaptive response?

lakshman239 — Mon, 07 Jun 2021 10:08:32 GMT

@phil_wong You would probably want to check the source- threat list activity for the duration that had unknown and find out which event is causing this? its most likely sending 'null' and causing this. If you can fix that, that could avoid 'unknown's coming in the rule/correlation searches.

hope this helps.

Re: How to ignore unknown objects in Risk adaptive response?

phil_wong — Tue, 08 Jun 2021 02:55:24 GMT

@lakshman239 There's is no "unknown" source from my intelligence. Indeed, some of my incidents got a IP hit my intelligence. So the score of the exact IP keeps raising which is reasonable. However, the same incident also has "unknown" src or user, make "unknown" got high score as well.