Workflows dependent on the content of a field

[sheamus69]

I am working on improving usage of the risk framework within our instance of Splunk ES.

At present there are a number of correlations that only generate risk scores, and we have alerting on risk objects with high risk scores.  While this approach reduces noise in IR, it does make it less intuitive to investigate the reasons a risk object scores so high.

I would like to find a way to picks up on what risks events were triggered for an object, and offer me appropriate workflows.

• So if an alert triggered for high risk objects, with the following risks events:
• Malware detected
  Suspicious Web Activity

Individual Workflows would be offered to help investigate each of these risks.

Has anyone else done something like this before?  Is it even possible? 

[thambisetty]

would you like to identify correlation search that adds risk score to an object which further causing high risk to an object?

[sheamus69]

No.  I have a correlation that flags a risk object that breeches a risk threashold. 

The notable generated lists the individual correlations that have generated these risks. 

What I am trying to do is have workflows available to assist with investigating these risks, but I only want them to be offered when a relevant risk is listed.

For example, if the risks generated included multiple failed logins and a malware alert, I would want a workflow to take me to a dashboard to investigate the failed logins and a separate workflow to look at the malware alert.  I want the workflows offered to reflect the risks generated for that notable.

Hope that makes more sense?