Splunk Enterprise Security
Highlighted

Splunk Enterprise Security: risk modifier from search pipeline not working

New Member

Used a search from the Splunk Risk Framework page:
http://dev.splunk.com/view/enterprise-security/SP-CAAAFBD

Search:
| makeresults | eval riskobject="mysystem"
| sendalert risk param.
riskscore="100" param.riskobjecttype="system"

I am not seeing the risk scores modified. the alert_actions.conf looks correct and have tried different objects with no luck. We have notables with risk modification running and those are working. Just not from the search pipeline.

Any ideas?

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

Builder

The example in the developer docs could perhaps be clearer. The first half of the example search is creating a dummy risk object called "mysystem". The second half is what you would use in your own environment, with the first half of the search being something specific that narrows down the search results to the object that you want to adjust the risk score for. Is that what you're doing already?

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

New Member

Tried both ways 😞 thought this would be a clearer example of the issue than my larger search. Good idea though!

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

Builder

Yeah, I figured you had 🙂 Wanted to make sure that wasn't what was happening, at least. This perplexes me. Are you getting an error, or how do you know that it isn't working?

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

New Member

no errors, i see a stats table when i run the sendalert risk command but no risk modifiers show up in Risk Analysis page or the lookup. It's like it never saves the modification.

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

Builder

Hmmmm. I have no more ideas.

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

Contributor

You need to include the param._risk_object_field and specify which field in your search contains the object you want to modify.
ex.
| makeresults | eval risk_object="username@domain.com" | sendalert risk param._risk_score="100" param._risk_object_field="risk_object" param._risk_object_type="user"

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

New Member

Thank you, wejust upgraded and this was fixed in the upgrade but it baffled several splunk resources as well. It pays to be on a current version.

0 Karma
Highlighted

Re: Splunk Enterprise Security: risk modifier from search pipeline not working

New Member

I was able to work this out. the | sendalert risk works from the search but not as a correlation search. |collect index="risk" works from the correlation search and is the new guidance over sendalert from Splunk PS.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.