Configure adaptive response actions for a correlation search in Splunk Enterprise Security

As a Splunk Enterprise Security admin, you can configure which adaptive response actions that a correlation search triggers.

Analysts can run some adaptive response actions on an ad hoc basis from Incident Review. See Included adaptive response actions with Splunk Enterprise Security in Use Splunk Enterprise Security.

Splunk Enterprise Security includes several adaptive response actions, and you can obtain additional ones from add-ons available on Splunkbase.

Included adaptive response actions

includes several adaptive response actions.

• Create a notable event.
• Modify a risk score with a risk modifier.
• Send an email.
• Run a script.
• Start a stream capture with Splunk Stream.
• Ping a host.
• Run Nbtstat.
• Run Nslookup.
• Add threat intelligence.
• Create a Splunk Web message.

Create a notable event

Create a notable event when the conditions of a correlation search are met.

1. On the menu bar, click Configure > Content Management.
2. Click an existing correlation search, or click Create New > Correlation Search.
3. Click Add New Response Action and select Notable to add a notable event.
4. Type a Title of the notable event on the Incident Review dashboard. Supports variable substitution from the fields in the matching event.
5. Type a Description of the notable event. Supports variable substitution from the fields in the matching event
6. Select the Security Domain of the notable event from the drop-down list.
7. Select the Severity of the notable event from the drop-down list. The severity is used to calculate the Urgency of a notable event.
8. (Optional) Change the default owner of the notable event from the system default, unassigned.
9. (Optional) Change the default status of the notable event from the system default, New.
10. Type a drill-down name for the Contributing Events link in the notable event.
11. Type a drill-down search for the Contributing Events link in the notable event.
12. In the Drill-down earliest offset field, type the amount of time before the time of the triggering event to look for related events for the Contributing Events link in the notable event.
    For example 2h to look for contributing events 2 hours before the triggering event.
13. In the Drill-down latest offset field, type the amount of time after the time of the triggering event to look for related events for the Contributing Events link in the notable event.
    For example, 1h to look for contributing events 1 hour after the triggering event.
14. (Optional) Add Investigation Profiles that apply to the notable event.
    For example, add an investigation profile that fits a use case of "Malware" to malware-related notable events.
15. (Optional) Add fields that contain assets in Asset Extraction to extract the field values and add them to the investigation workbench as artifacts when the notable event is added to an investigation.
16. (Optional) Add fields that contain identities in Identity Extraction to extract the field values and add them to the investigation workbench as an artifact when the notable event is added to an investigation.
17. Type Next Steps for an analyst to take after triaging a notable event. Type text or click Insert Adaptive Response Action to reference a response action in the text of the next steps. You can only type plain text and links to response actions in the next steps field. Use next steps if you want to recommend response actions that should be taken in a specific order.
    For example, ping a host to determine if it is active on the network. If the host is active, increase the risk score by 100, otherwise, increase the risk score by 50.
18. Select Recommended Actions to complement the next steps. From the list of all adaptive response actions, click the name of an action that you recommend as a triage or investigation step for this notable event to add it to the list of recommended actions that analysts can take for this notable event. You can add as many recommended actions as you like. Use recommended actions to recommend response actions that do not need to be taken in a specific order.
    For example, increase the risk score on a host and perform an nslookup on a domain name.

Modify a risk score with a risk modifier

Modify a risk score as a result of a correlation search or in response to notable event details with the Risk Analysis adaptive response action. The risk adaptive response action creates a risk modifier event. You can view the risk modifier events on the Risk Analysis dashboard in Enterprise Security.

1. Click Add New Response Action and select Risk Analysis.
2. Type the score to assign to the risk object.
3. Type a field in the search to apply the risk score to for the Risk Object Field.
   For example, type "src" to specify the source field.
4. Select the Risk Object Type to apply the risk score to.

See Assign risk to an object in Use Splunk Enterprise Security for other ways to modify risk scores.

Send an email

Send an email as a result of a correlation search match.

Prerequisite

Make sure that the mail server is configured in the Splunk platform before setting up this response action.

• For Splunk Enterprise, see Configure email notification settings in the Splunk Enterprise Alerting Manual.
• For Splunk Cloud, see Configure email notification settings in the Splunk Cloud Alerting Manual.

Steps

1. Click Add New Response Action and select Send email.
2. In the To field, type a comma-separated list of email addresses to send the email to.
3. (Optional) Change the priority of the email. Defaults to Lowest.
4. Type a subject for the email. The email subject defaults to "Splunk Alert: $name$", where $name$ is the correlation search Search Name.
5. Type a message to include as the body of the email. Defaults to "The scheduled report '$name$' has run."
6. Select the check boxes of the information you want the email message to include.
7. Select whether to send a plain-text or HTML and plain-text email message.

Run a script

Run a script stored in $SPLUNK_HOME/bin/scripts.

1. Click Add New Response Action and select Run a script.
2. Type the filename of the script.

More information about scripted alerts can be found in the Splunk platform documentation.

• For Splunk Enterprise, see Configure scripted alerts in the Splunk Enterprise Alerting Manual.
• For Splunk Cloud, see Configure scripted alerts in the Splunk Cloud Alerting Manual.

Start a stream capture with Splunk Stream

Start a stream capture to capture packets on the IP addresses of the selected protocols over the time period that you select. You can view the results of the capture session on the Protocol Intelligence dashboards.

A stream capture will not work unless you integrate Splunk Stream with . See Integrate Splunk Stream with Splunk Enterprise Security.

1. Click Add New Response Action and select Stream Capture to start a packet capture in response to a correlation search match.
2. Type a Description to describe the stream created in response to the correlation search match.
3. Type a Category to define the type of stream capture. You can view streams by category in Splunk Stream.
4. Type the comma-separated event fields to search for IP addresses for the Stream capture. The first non-null field is used for the capture.
5. Type the comma-separated list of protocols to capture.
6. Select a Capture duration to define the length of the packet capture.
7. Type a Stream capture limit to limit the number of stream captures started by the correlation search.

Ping a host

Determine whether a host is still active on the network by pinging the host.

1. Click Add New Response Action and select Ping.
2. Type the event field that contains the host that you want to ping in the Host Field.
3. Type the number of maximum results that the ping returns. Defaults to 1.

Run nbtstat

Learn more about a host and the services that the host runs by running nbtstat.

1. Click Add New Response Action and select Nbtstat.
2. Type the event field that contains the host that you want to run the nbtstat for in the Host Field.
3. Type the number of maximum results that the nbtstat returns. Defaults to 1.

Run nslookup

Look up the domain name of an IP address, or the IP address of a domain name, by running nslookup.

1. Click Add New Response Action and select Nslookup.
2. Type the event field that contains the host that you want to run the nslookup for in the Host Field.
3. Type the number of maximum results that the nslookup returns. Defaults to 1.

Add threat intelligence

Create threat artifacts in a threat collection.

1. Click Add New Response Action and select Add Threat Intelligence.
2. Select the Threat Group to attribute this artifact to.
3. Select the Threat Collection to insert the threat artifact into.
4. Type the Search Field that contains the value to insert into the threat artifact.
5. Type a Description for the threat artifact.
6. Type a Weight associated with the threat list. Defaults to 1.
7. Type a number of Max Results to specify the number of results to process as threat artifacts. Each unique search field value counts as a result. Defaults to 100.