Splunk Enterprise Security

Workflows dependent on the content of a field

sheamus69
Communicator

I am working on improving usage of the risk framework within our instance of Splunk ES.

At present there are a number of correlations that only generate risk scores, and we have alerting on risk objects with high risk scores.  While this approach reduces noise in IR, it does make it less intuitive to investigate the reasons a risk object scores so high.

I would like to find a way to picks up on what risks events were triggered for an object, and offer me appropriate workflows.

 

  • So if an alert triggered for high risk objects, with the following risks events:
  • Malware detected
    Suspicious Web Activity

Individual Workflows would be offered to help investigate each of these risks.

Has anyone else done something like this before?  Is it even possible? 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

would you like to identify correlation search that adds risk score to an object which further causing high risk to an object?

————————————
If this helps, give a like below.
0 Karma

sheamus69
Communicator

No.  I have a correlation that flags a risk object that breeches a risk threashold. 

The notable generated lists the individual correlations that have generated these risks. 

What I am trying to do is have workflows available to assist with investigating these risks, but I only want them to be offered when a relevant risk is listed.

For example, if the risks generated included multiple failed logins and a malware alert, I would want a workflow to take me to a dashboard to investigate the failed logins and a separate workflow to look at the malware alert.  I want the workflows offered to reflect the risks generated for that notable.

Hope that makes more sense?

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...