Splunk Enterprise Security

Risk Based alerting in SPLUNK ES

snsaxena
Loves-to-Learn Lots

I want to enable risk based alerting as a part of threat hunting.
Usecase- lf a malicious file is transmitted, risk score should be added by 10, if the file is triggered risk score should be updated by +20. and an alert should be triggered only if risk_score>=30.

Can I accomplish it writing a correlation search?  Or there is another way of doing it, please suggest.

 

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

Yes, with correlation searches that use the Risk data model. Also, assuming that you want to use security framework annotations:
https://docs.splunk.com/Documentation/ES/6.5.1/Admin/Configurecorrelationsearches#Use_security_frame... 
make sure to check out step 3 & 4... in this release, the Notable and the Risk Analysis adaptive responses work a little differently: 

3. (Conditional) If you are using the adaptive response action of Notable because you want see annotations as field labels in Incident Review, and if you are editing a correlation search that does not use the Risk data model, then you need to append an eval statement for the annotations.mitre_attack field to end of the correlation search, such as:

| from datamodel:"Identity_Management"."Expired_Identity_Activity" | stats max("_time") as "lastTime",latest("_raw") as "orig_raw",count by "expired_user" | rename "expired_user" as "user" | eval annotations.mitre_attack="T1027"

4. (Conditional) If you are using the adaptive response action of Risk Analysis because you want see annotations as field labels in the Risk Analysis Dashboard, the annotations show up automatically. For more information about creating risk factors to adjust risk scores for risk objects, see Create risk factors in Splunk Enterprise Security.

Let me know if that helps. 

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...