So basically I'm trying to generate an event when a risk score above 100 is generated, I've come up with the below search string. Please, can you help me in identifying if anything needs to be changed?
| tstats allow_old_summaries=`allow_old_summaries_bool` sum(All_Risk.src) as src,from datamodel=Risk by All_Risk.src | where risk_score>=100 | stats values(risk_score) by src
This is what my data model currently looks like.
... View more
Splunk Enterprise Security: why am I getting this error message?
msg="A threat intelligence download has failed" stanza="alexa_top_one_million_sites" status="threat list download failed after multiple retries"
... View more