Splunk Enterprise Security

Assign multiple risk objects in Risk Analysis

vamshikn72
Explorer

How to assign multiple risk object fields and object types in Risk analysis response action. I know it's possible from search using appendpipe and sendalert but we want this to be added from the response action.

Example as below:

Risk Score - 20

Risk Object Field - user, ip, host

Risk Object Type - System, user

vamshikn72_0-1619547260431.png

 

0 Karma
1 Solution

bowesmana
Champion

In your correlation search create a fields risk_object and risk_object_type containing your values and have one row per risk entry you want to create. You can also give each row a different risk score if you want to. This example shows how you can use those fields.

| makeresults
| fields - _time
| eval risk_object=split("vamshikn72:user,10.10.13.11:system,machine1:system", ",")
| mvexpand risk_object
| rex field=risk_object "(?<risk_object>[^:]*):(?<risk_object_type>.*)"
| eval risk_score=20

In the configuration dialog, just leave the risk object and type fields blank. If you include a score field in the row, it will use that instead.

View solution in original post

0 Karma

MaverickT
Communicator

The easyest way is to upgrade your Enterprise Security to 6.4, which has the option to add multiple risk analysis to the same result.

 

MaverickT_0-1619763085817.png

 

vamshikn72
Explorer

Thanks @MaverickT. We came to know about this later and asked our admins to upgrade.

0 Karma

bowesmana
Champion

In your correlation search create a fields risk_object and risk_object_type containing your values and have one row per risk entry you want to create. You can also give each row a different risk score if you want to. This example shows how you can use those fields.

| makeresults
| fields - _time
| eval risk_object=split("vamshikn72:user,10.10.13.11:system,machine1:system", ",")
| mvexpand risk_object
| rex field=risk_object "(?<risk_object>[^:]*):(?<risk_object_type>.*)"
| eval risk_score=20

In the configuration dialog, just leave the risk object and type fields blank. If you include a score field in the row, it will use that instead.

View solution in original post

0 Karma

vamshikn72
Explorer

Hi @bowesmana, Passing blank values in the response action and adding scores to the eval helped me a lot. Thanks for your quick help.

Search example I used:

| makeresults
| eval field_user="noob", field_ip="8.8.8.8", field_host="machine"
| eval risk_object=if(isnotnull(field_host),field_host,null()),risk_object_type=if(isnotnull(field_host),"system",null())
| appendpipe
[| eval risk_object=if(isnotnull(field_user),field_user,null()),risk_object_type=if(isnotnull(field_user),"user",null())]
| appendpipe
[| eval risk_object=if(isnotnull(field_ip),field_ip,null()),risk_object_type=if(isnotnull(field_ip),"system",null())]
| eval risk_score=20
| fields - _time field_user field_ip field_host

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.