Splunk Enterprise Security

Workflows dependent on the content of a field

sheamus69
Communicator

I am working on improving usage of the risk framework within our instance of Splunk ES.

At present there are a number of correlations that only generate risk scores, and we have alerting on risk objects with high risk scores.  While this approach reduces noise in IR, it does make it less intuitive to investigate the reasons a risk object scores so high.

I would like to find a way to picks up on what risks events were triggered for an object, and offer me appropriate workflows.

 

  • So if an alert triggered for high risk objects, with the following risks events:
  • Malware detected
    Suspicious Web Activity

Individual Workflows would be offered to help investigate each of these risks.

Has anyone else done something like this before?  Is it even possible? 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

would you like to identify correlation search that adds risk score to an object which further causing high risk to an object?

————————————
If this helps, give a like below.
0 Karma

sheamus69
Communicator

No.  I have a correlation that flags a risk object that breeches a risk threashold. 

The notable generated lists the individual correlations that have generated these risks. 

What I am trying to do is have workflows available to assist with investigating these risks, but I only want them to be offered when a relevant risk is listed.

For example, if the risks generated included multiple failed logins and a malware alert, I would want a workflow to take me to a dashboard to investigate the failed logins and a separate workflow to look at the malware alert.  I want the workflows offered to reflect the risks generated for that notable.

Hope that makes more sense?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...