I am working on improving usage of the risk framework within our instance of Splunk ES.
At present there are a number of correlations that only generate risk scores, and we have alerting on risk objects with high risk scores. While this approach reduces noise in IR, it does make it less intuitive to investigate the reasons a risk object scores so high.
I would like to find a way to picks up on what risks events were triggered for an object, and offer me appropriate workflows.
So if an alert triggered for high risk objects, with the following risks events:
Malware detected Suspicious Web Activity
Individual Workflows would be offered to help investigate each of these risks.
Has anyone else done something like this before? Is it even possible?
No. I have a correlation that flags a risk object that breeches a risk threashold.
The notable generated lists the individual correlations that have generated these risks.
What I am trying to do is have workflows available to assist with investigating these risks, but I only want them to be offered when a relevant risk is listed.
For example, if the risks generated included multiple failed logins and a malware alert, I would want a workflow to take me to a dashboard to investigate the failed logins and a separate workflow to look at the malware alert. I want the workflows offered to reflect the risks generated for that notable.