Splunk Enterprise Security

Workflows dependent on the content of a field


I am working on improving usage of the risk framework within our instance of Splunk ES.

At present there are a number of correlations that only generate risk scores, and we have alerting on risk objects with high risk scores.  While this approach reduces noise in IR, it does make it less intuitive to investigate the reasons a risk object scores so high.

I would like to find a way to picks up on what risks events were triggered for an object, and offer me appropriate workflows.


  • So if an alert triggered for high risk objects, with the following risks events:
  • Malware detected
    Suspicious Web Activity

Individual Workflows would be offered to help investigate each of these risks.

Has anyone else done something like this before?  Is it even possible? 

0 Karma

Super Champion

would you like to identify correlation search that adds risk score to an object which further causing high risk to an object?

If this helps, give a like below.
0 Karma


No.  I have a correlation that flags a risk object that breeches a risk threashold. 

The notable generated lists the individual correlations that have generated these risks. 

What I am trying to do is have workflows available to assist with investigating these risks, but I only want them to be offered when a relevant risk is listed.

For example, if the risks generated included multiple failed logins and a malware alert, I would want a workflow to take me to a dashboard to investigate the failed logins and a separate workflow to look at the malware alert.  I want the workflows offered to reflect the risks generated for that notable.

Hope that makes more sense?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...