Splunk Enterprise Security

Risk Based alerting in SPLUNK ES

snsaxena
Loves-to-Learn Lots

I want to enable risk based alerting as a part of threat hunting.
Usecase- lf a malicious file is transmitted, risk score should be added by 10, if the file is triggered risk score should be updated by +20. and an alert should be triggered only if risk_score>=30.

Can I accomplish it writing a correlation search?  Or there is another way of doing it, please suggest.

 

0 Karma

lkutch_splunk
Splunk Employee
Splunk Employee

Yes, with correlation searches that use the Risk data model. Also, assuming that you want to use security framework annotations:
https://docs.splunk.com/Documentation/ES/6.5.1/Admin/Configurecorrelationsearches#Use_security_frame... 
make sure to check out step 3 & 4... in this release, the Notable and the Risk Analysis adaptive responses work a little differently: 

3. (Conditional) If you are using the adaptive response action of Notable because you want see annotations as field labels in Incident Review, and if you are editing a correlation search that does not use the Risk data model, then you need to append an eval statement for the annotations.mitre_attack field to end of the correlation search, such as:

| from datamodel:"Identity_Management"."Expired_Identity_Activity" | stats max("_time") as "lastTime",latest("_raw") as "orig_raw",count by "expired_user" | rename "expired_user" as "user" | eval annotations.mitre_attack="T1027"

4. (Conditional) If you are using the adaptive response action of Risk Analysis because you want see annotations as field labels in the Risk Analysis Dashboard, the annotations show up automatically. For more information about creating risk factors to adjust risk scores for risk objects, see Create risk factors in Splunk Enterprise Security.

Let me know if that helps. 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...