Splunk Enterprise Security
Highlighted

Enterprise Security: what makes a correlation search a correlation search?

Motivator

I'm looking at a sample correlation search called Abnormally High Number of HTTP Method Events By Src -

| tstats `summariesonly` count as web_event_count from datamodel=Web.Web by Web.src, Web.http_method 
| `drop_dm_object_name("Web")` 
| xswhere web_event_count FROM count_by_http_method_by_src_1d in web by http_method is above high

What makes it a correlation search?

0 Karma
Highlighted

Re: Enterprise Security: what makes a correlation search a correlation search?

Splunk Employee
Splunk Employee

Hi,
According to the ES tutorial... it's not just a search, but a search that then does one of the following:
"A correlation search is a type of search that evaluates events from one or more data sources for defined patterns. When the search finds a pattern, it creates a notable event, adjusts a risk score, or performs an adaptive response action. A correlation search is a saved search with extended capabilities making it easier to create, edit, and use searches for security use cases."
https://docs.splunk.com/Documentation/ES/5.3.1/Tutorials/CorrelationSearch

So since it creates a notable event, it's a correlation search.

View solution in original post

Highlighted

Re: Enterprise Security: what makes a correlation search a correlation search?

Motivator

Ok, makes sense.

This particular search has the following Adaptive Response Actions -

1) Risk Analysis
2) Notable