How to ignore unknown objects in Risk adaptive response?

[phil_wong]

Hi,

There're some incidents hit my threat intelligence IP, e.g. dest. That's why Threat Activity notable event is triggered which is good to see.

However, my concern is it would at the same time multiple the score of "unknown" user and "unknown" src/dest. 

How can I filter these noise effectively, so not so many false alert introduced by "unknown" user or IP?

[lakshman239]

@phil_wong  You would probably want to check the source- threat list activity for the duration that had unknown and find out which event is causing this? its most likely sending 'null' and causing this. If you can fix that, that could avoid 'unknown's coming in the rule/correlation searches.

hope this helps.

[phil_wong]

@lakshman239 There's is no "unknown" source from my intelligence. Indeed, some of my incidents got a IP hit my intelligence. So the score of the exact IP keeps raising which is reasonable. However, the same incident also has "unknown" src or user, make "unknown" got high score as well.