Q1: Where should a novice begin with RBA?

A:   

• plan a small use case
• ensure risk notables are in QA mode
• create a tag/eventtype for risk rule QA mode
• play / dig into risk index occasionally

Q2: RBA asks for a static risk score, but how do I manage this with a dynamic risk score depending on the query(SPL)?

A: 

• eval is your best friend
• | index=edr_alerts NOT severity IN (“critical”,”high”)
• | eval risk_score = case(
• severity="medium","50",
• severity=”low”,”25”,
• severity=”info”,”10”)

Q3: Can you talk about the best practice of using a variable/token for the risk score?

A:

• separate noisy sub-types of results
• to find them, try various | stats count by field1, field2, field3 OR patterns tab
• separating out low signal makes every event more meaningful

Live Questions: (refer to the recording)

• How are you going to determine if a particular machine is attacked and our asset score has not breached the default targeted risk but still that is a true positive?
• When using RBA in our lab, the notable RBA constantly repeats itself in ES Incident Review. How to deal with that?
• What's the best way to whitelist known activities or users performing business activities, without suppressing notables?