Splunk Enterprise Security

Tuning Risk Scores and resetting score values

sheamus69
Communicator

Hi,

I'm in the process of tuning our risk scores, as applied to objects (users or assets) from a correlation search.

What I'm uncertain about is, once I have configured the scoring in a manner that I am happy with, can I reset all the scores currently applied to objects so as to operate from a fresh start? The existing risk scores, being poorly configured, would presumably skew any risk analysis results going forward?

Any advice given here would be gratefully recieved.

Sheamus.

Edit:

This question is for Splunk Enterprise Security 4.0.1.

0 Karma
1 Solution

sheamus69
Communicator

OK, I think I've figured this out for myself.

Splunk doesnt need to baseline the scores, as the scores are calculated for a given timeframe. So a systems risk score would give a different value when looked a over 24 hours as opposed to over 7 days.

This effectively means that old risk values will drop out over time - which should reflect the fact that risk factors would, hopefully, get rectified once identified.

View solution in original post

0 Karma

sheamus69
Communicator

OK, I think I've figured this out for myself.

Splunk doesnt need to baseline the scores, as the scores are calculated for a given timeframe. So a systems risk score would give a different value when looked a over 24 hours as opposed to over 7 days.

This effectively means that old risk values will drop out over time - which should reflect the fact that risk factors would, hopefully, get rectified once identified.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is this question for splunk enterprise security?

sheamus69
Communicator

Yes, Splunk ES 4.0.1. Apologies, should have given that information.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...