Risk Based alerting in SPLUNK ES

[snsaxena]

I want to enable risk based alerting as a part of threat hunting.
Usecase- lf a malicious file is transmitted, risk score should be added by 10, if the file is triggered risk score should be updated by +20. and an alert should be triggered only if risk_score>=30.

Can I accomplish it writing a correlation search?  Or there is another way of doing it, please suggest.

[lkutch_splunk]

Yes, with correlation searches that use the Risk data model. Also, assuming that you want to use security framework annotations:
https://docs.splunk.com/Documentation/ES/6.5.1/Admin/Configurecorrelationsearches#Use_security_frame... 
make sure to check out step 3 & 4... in this release, the Notable and the Risk Analysis adaptive responses work a little differently: 

3. (Conditional) If you are using the adaptive response action of Notable because you want see annotations as field labels in Incident Review, and if you are editing a correlation search that does not use the Risk data model, then you need to append an eval statement for the annotations.mitre_attack field to end of the correlation search, such as:

| from datamodel:"Identity_Management"."Expired_Identity_Activity" | stats max("_time") as "lastTime",latest("_raw") as "orig_raw",count by "expired_user" | rename "expired_user" as "user" | eval annotations.mitre_attack="T1027"

4. (Conditional) If you are using the adaptive response action of Risk Analysis because you want see annotations as field labels in the Risk Analysis Dashboard, the annotations show up automatically. For more information about creating risk factors to adjust risk scores for risk objects, see Create risk factors in Splunk Enterprise Security.

Let me know if that helps.