Splunk Enterprise Security

Tuning Risk Scores and resetting score values

sheamus69
Communicator

Hi,

I'm in the process of tuning our risk scores, as applied to objects (users or assets) from a correlation search.

What I'm uncertain about is, once I have configured the scoring in a manner that I am happy with, can I reset all the scores currently applied to objects so as to operate from a fresh start? The existing risk scores, being poorly configured, would presumably skew any risk analysis results going forward?

Any advice given here would be gratefully recieved.

Sheamus.

Edit:

This question is for Splunk Enterprise Security 4.0.1.

0 Karma
1 Solution

sheamus69
Communicator

OK, I think I've figured this out for myself.

Splunk doesnt need to baseline the scores, as the scores are calculated for a given timeframe. So a systems risk score would give a different value when looked a over 24 hours as opposed to over 7 days.

This effectively means that old risk values will drop out over time - which should reflect the fact that risk factors would, hopefully, get rectified once identified.

View solution in original post

0 Karma

sheamus69
Communicator

OK, I think I've figured this out for myself.

Splunk doesnt need to baseline the scores, as the scores are calculated for a given timeframe. So a systems risk score would give a different value when looked a over 24 hours as opposed to over 7 days.

This effectively means that old risk values will drop out over time - which should reflect the fact that risk factors would, hopefully, get rectified once identified.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is this question for splunk enterprise security?

sheamus69
Communicator

Yes, Splunk ES 4.0.1. Apologies, should have given that information.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...