Splunk Enterprise Security

How to ignore unknown objects in Risk adaptive response?

phil_wong
Explorer

Hi,

There're some incidents hit my threat intelligence IP, e.g. dest. That's why Threat Activity notable event is triggered which is good to see.

However, my concern is it would at the same time multiple the score of "unknown" user and "unknown" src/dest. 

How can I filter these noise effectively, so not so many false alert introduced by "unknown" user or IP?

Labels (1)
Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

@phil_wong  You would probably want to check the source- threat list activity for the duration that had unknown and find out which event is causing this? its most likely sending 'null' and causing this. If you can fix that, that could avoid 'unknown's coming in the rule/correlation searches.

hope this helps.

0 Karma

phil_wong
Explorer

@lakshman239 There's is no "unknown" source from my intelligence. Indeed, some of my incidents got a IP hit my intelligence. So the score of the exact IP keeps raising which is reasonable. However, the same incident also has "unknown" src or user, make "unknown" got high score as well. 

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...