Splunk Enterprise Security

How to ignore unknown objects in Risk adaptive response?

phil_wong
Explorer

Hi,

There're some incidents hit my threat intelligence IP, e.g. dest. That's why Threat Activity notable event is triggered which is good to see.

However, my concern is it would at the same time multiple the score of "unknown" user and "unknown" src/dest. 

How can I filter these noise effectively, so not so many false alert introduced by "unknown" user or IP?

Labels (1)
Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

@phil_wong  You would probably want to check the source- threat list activity for the duration that had unknown and find out which event is causing this? its most likely sending 'null' and causing this. If you can fix that, that could avoid 'unknown's coming in the rule/correlation searches.

hope this helps.

0 Karma

phil_wong
Explorer

@lakshman239 There's is no "unknown" source from my intelligence. Indeed, some of my incidents got a IP hit my intelligence. So the score of the exact IP keeps raising which is reasonable. However, the same incident also has "unknown" src or user, make "unknown" got high score as well. 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...