Intermediate findings in analyst queue ES v8.3

[splunkreal]

Hello, us there still Intermediate findings column for findings in analyst queue for Event based detections?

Thanks.

[diogofgm]

"Intermediate Findings" is the equivalent of what you had as a risk event back in Splunk ES 7.x so it doesn't get written to the notable index. A "finding" is what used to be called a "notable" which is written in the Notable index. 

The intermediate findings column is still available in the analyst queue and it will show the number of intermediate findings that contributed to a finding based detection (e.g. Findings Risk Threshold Exceeded for Entity Over 24 Hour Period)

Check this presentation from last year by Splunk Security Product Specialist that explains the change in terminology:

https://www.splunk.com/en_us/pdfs/infographics/splunk-enterprise-security-8-x-tech-talk-2025.pdf

[Dpop]

Hey Dio,

So do intermediate findings not get the enrichment from risk and other automatic lookups in the same way a "finding" does?

Or... does it feel as if all event-based searches should have a "finding" result to get that enrichment? Or should I expand the SPL for the event-based search to included the risk datamodel?

[diogofgm]

They are both event-based detections where the diference is the output. One writes in the notables index and shows up in the analyst queue and the other writes to the risk index and does not show p in the analyst queue . Both leverage existing lookups (e.g. assets and identities lookups). Both can assign risk to assets or identities. 
The reasoning behind this is, if you have something that when you detect it the analyst should do something or investigate it right away you most likely set it as a finding. On the other hand if that something isn't a big issue unless it's detected along side with other behavior then you can set it as an intermediate finding.

As an example:

If you have detected some host communication with a known C2 IP, you really want someone to act on it. This kind of detections where you have a high confidence and its high severity, these should be findings. 

If you have detected someone accessing some sensitive files after-hours you probably don't need to have an analyst look into it right away, but you can still register that as an intermediate finding and give it some risk. The same logic can be applied to detecting a "usb device connected to a host" or "large volume of files download". Individually they might not be high severity and not worth to have an analyst look in to it right away, but when detected together you might be looking into data exfiltration. All the accumulated risk from these intermediate findings can push the total risk above your risk score threshold and trigger a finding based detection like the ones you can find out of the box in ES (e.g. "Finding Group - Entity Exceeded Threshold with Multiple Findings" or "Findings Risk Threshold Exceeded for Entity Over 24 Hour Period"). 

[Dpop]

I have the same question. I have a handful of event-based findings that I do not see populated in Mission Control. Based upon Splunk Docs, you either need to enable "Intermediate Finding" or "Finding" for the output. I also leverage a SOAR platform but notice that none of my event based findings get enriched with risk and other automatic lookups/metadata that gets added AFTER an event-based finding has a result. 

From what I see, Intermediate Findings also don't get written to index=notable. Does anyone have insight on how I can see intermediate findings and also find the data in a Splunk index?