Splunk Enterprise Security

How to ignore unknown objects in Risk adaptive response?

phil_wong
Explorer

Hi,

There're some incidents hit my threat intelligence IP, e.g. dest. That's why Threat Activity notable event is triggered which is good to see.

However, my concern is it would at the same time multiple the score of "unknown" user and "unknown" src/dest. 

How can I filter these noise effectively, so not so many false alert introduced by "unknown" user or IP?

Labels (1)
Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

@phil_wong  You would probably want to check the source- threat list activity for the duration that had unknown and find out which event is causing this? its most likely sending 'null' and causing this. If you can fix that, that could avoid 'unknown's coming in the rule/correlation searches.

hope this helps.

0 Karma

phil_wong
Explorer

@lakshman239 There's is no "unknown" source from my intelligence. Indeed, some of my incidents got a IP hit my intelligence. So the score of the exact IP keeps raising which is reasonable. However, the same incident also has "unknown" src or user, make "unknown" got high score as well. 

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...