Risk Notables- How can we exclude users from correlation searches?

[VK18]

Hi All,

There are few risk notable events getting generated in the Incident review page as part of correlation searches being run.

How can we exclude few users (who are from SOC team) from correlation searches which are being run. Correlation searches like " OT Sec- Execution Process Spawning cmd.exe" are enabled in our network, which are getting triggered when SOC team opens any chrome, exe's etc.

Hence, we need to exclude few users from risk generating notables or please suggest any other option which might be useful to get rid of these risk notables.

Regards
VK

[meetmshah]

Hello @VK18, There is no native way of "suppressing" Risk events like notable (as mentioned here - https://docs.splunk.com/Documentation/ES/7.1.1/User/RiskScoring#:~:text=It%20is%20also%20worth%20not...

We can use alert throttling OR add ad-hoc Risk entry from Risk Analysis Dashboard. Below are the reference Docs - 

Create an ad hoc risk entry in Splunk Enterprise Security - https://docs.splunk.com/Documentation/ES/7.1.1/User/Createadhocriskentry

Suppressing false positives using alert throttling - https://docs.splunk.com/Documentation/ES/7.1.1/RBA/UseDynamicThrottling

Also, if you are using Risk Notable (Notable that gets triggered when a certain threshold is reached), you can also filter / blacklist Risk Object through lookup.

Please accept the solution if this helps!

[VK18]

Hi @meetmshah,

Also, if you are using Risk Notable (Notable that gets triggered when a certain threshold is reached), you can also filter / blacklist Risk Object through lookup.
For the above option, Is there lookup format for creating a lookup table to filter/blacklist Risk object(users). Can I use below structure ? 

Risk object	status
user 1	allowed
user2	allowed
user3	allowed

[meetmshah · Accepted solution]

Hello @VK18,

There is no specific / pre-defined template as such. We can simply use the columns that you shared to filter it via the "flag" approach (ie. adding filter flag!=1 or status!=allowed at the end of the search)

[meetmshah]

Hello, Just checking through if the issue was resolved or you have any further questions?

[gcusello]

Hi @VK18,

open the dropdown list in tthe rights side of the screen and select "Suppress".

In this way you can create a Suppression Rule that exclude the resullts of that notable from that Correlation Search Results.

You can also give a duration (or also not!) to this Suppressione Rule.

In the Management menu there's a function to manage Suppression Rules.

Ciao.

Giuseppe

[gcusello]

Hi @VK18 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉