Splunk Enterprise Security

Risk Based alerting in SPLUNK ES

snsaxena
Loves-to-Learn Lots

I want to enable risk based alerting as a part of threat hunting.
Usecase- lf a malicious file is transmitted, risk score should be added by 10, if the file is triggered risk score should be updated by +20. and an alert should be triggered only if risk_score>=30.

Can I accomplish it writing a correlation search?  Or there is another way of doing it, please suggest.

 

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

Yes, with correlation searches that use the Risk data model. Also, assuming that you want to use security framework annotations:
https://docs.splunk.com/Documentation/ES/6.5.1/Admin/Configurecorrelationsearches#Use_security_frame... 
make sure to check out step 3 & 4... in this release, the Notable and the Risk Analysis adaptive responses work a little differently: 

3. (Conditional) If you are using the adaptive response action of Notable because you want see annotations as field labels in Incident Review, and if you are editing a correlation search that does not use the Risk data model, then you need to append an eval statement for the annotations.mitre_attack field to end of the correlation search, such as:

| from datamodel:"Identity_Management"."Expired_Identity_Activity" | stats max("_time") as "lastTime",latest("_raw") as "orig_raw",count by "expired_user" | rename "expired_user" as "user" | eval annotations.mitre_attack="T1027"

4. (Conditional) If you are using the adaptive response action of Risk Analysis because you want see annotations as field labels in the Risk Analysis Dashboard, the annotations show up automatically. For more information about creating risk factors to adjust risk scores for risk objects, see Create risk factors in Splunk Enterprise Security.

Let me know if that helps. 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...