How can I configure a Correlation Search in ES to add risk to 2 objects (src & dest)? I can only configure a Adaptive Response Action once from the drop down menu.
Savedsearches.conf shows the following:
action.risk = 1
action.risk.param._risk_object = src
action.risk.param._risk_object_type = system
action.risk.param._risk_score = 60
action.risk.param.verbose = 0
action.risk = 1 just means this is enabled. I can't add a second set of paramaters with action.risk = 2 for a second instance of that action right? At least it did not work for me when i tried it.
Splunk Version: 6.6.3
ES Version: 4.7.4
Sorry @chris, it isn't possible today to run multiple adaptive response actions of the same type on different fields.
For your specific example, you can add risk to dest by modifying the search syntax of the correlation search. See http://dev.splunk.com/view/enterprise-security/SP-CAAAFBD for examples using |sendalert
It seems like I was too quick accepting your answer. The risk is added if I do a manual search, but the correlation search does not generate a notable event anymore if I add | localop
| eval risk_object=user | sendalert risk param._risk_object_type="user" param._risk_score=60 | rename risk_object as myrisk_object I tried with and without the localop command. Any Ideas
This ist the error I see in the search.log if I go the job inspector:
11-30-2017 14:40:06.168 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'sendalert' command: Alert script returned error code 3.
A number of us have a feature request in to support GUI multiple occurrences of the same adaptive response in a correlation search. But its a road map kind of thing since it requires the ES developers to rework a lot of code.