Hello,
We ingest logs from another vendor to Splunk, each event contains a "score" field which is predetermined by the 3rd party ranging from 0 - 100.
Is there away to add that field value to the risk object score instead of a static risk score in the Risk analysis Adaptive response?
Have been looking at using the Risk factor editor but cant see a way other than setting the static value in the Adaptive response to 100 then creating 100 risk factor like this
if('score'="10",0.1,1)
if('score'="11",0.11,1)
if('score'="12",0.12,1) so on and so on.
Thanks
