- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
RBA - Use preexisting field for risk object score
Scottk1
Loves-to-Learn Lots
09-26-2023
05:01 AM
Hello,
We ingest logs from another vendor to Splunk, each event contains a "score" field which is predetermined by the 3rd party ranging from 0 - 100.
Is there away to add that field value to the risk object score instead of a static risk score in the Risk analysis Adaptive response?
Have been looking at using the Risk factor editor but cant see a way other than setting the static value in the Adaptive response to 100 then creating 100 risk factor like this
if('score'="10",0.1,1)
if('score'="11",0.11,1)
if('score'="12",0.12,1) so on and so on.
Thanks
