Splunk Enterprise Security

Splunk Enterprise Security: How can I configure a Correlation Search to add risk to 2 objects?

chris
Motivator

Hi,

How can I configure a Correlation Search in ES to add risk to 2 objects (src & dest)? I can only configure a Adaptive Response Action once from the drop down menu.

Savedsearches.conf shows the following:
action.risk = 1
action.risk.param._risk_object = src
action.risk.param._risk_object_type = system
action.risk.param._risk_score = 60
action.risk.param.verbose = 0

action.risk = 1 just means this is enabled. I can't add a second set of paramaters with action.risk = 2 for a second instance of that action right? At least it did not work for me when i tried it.

Regards
Chris

Splunk Version: 6.6.3
ES Version: 4.7.4

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Sorry @chris, it isn't possible today to run multiple adaptive response actions of the same type on different fields.

For your specific example, you can add risk to dest by modifying the search syntax of the correlation search. See http://dev.splunk.com/view/enterprise-security/SP-CAAAFBD for examples using |sendalert

chris
Motivator

It seems like I was too quick accepting your answer. The risk is added if I do a manual search, but the correlation search does not generate a notable event anymore if I add | localop

| eval risk_object=user | sendalert risk param._risk_object_type="user" param._risk_score=60 | rename risk_object as myrisk_object I tried with and without the localop command. Any Ideas

0 Karma

chris
Motivator

I added the | rename risk_object as myrisk_object to test if the field was somehow relevant it does not make a difference if it is in place or not

0 Karma

chris
Motivator

This ist the error I see in the search.log if I go the job inspector:
11-30-2017 14:40:06.168 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'sendalert' command: Alert script returned error code 3.

0 Karma

chris
Motivator

This works, thank you very much.

0 Karma

starcher
SplunkTrust
SplunkTrust

A number of us have a feature request in to support GUI multiple occurrences of the same adaptive response in a correlation search. But its a road map kind of thing since it requires the ES developers to rework a lot of code.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>