Configure risk scoring

A risk score is a single metric that shows the relative risk of a device or user in the network environment over time. Splunk Enterprise Security classifies a device as a system, a user as a user, and unrecognized devices or users as other.

Enterprise Security uses risk analysis to take note of and calculate the risk of small events and suspicious behavior over time to your environment. The Risk Analysis dashboard displays these risk scores and other risk-related information.

Assigning risk

Create a risk analysis response action, or risk modifier, to assign risk to an object. You can assign risk to objects in several ways.

• Assign risk automatically as part of a correlation search. See Modify a risk score with a risk modifier.
• Assign risk on an ad-hoc basis from Incident Review. See Modify a risk score with a risk modifier.
• Assign risk through a search. See Risk Analysis Framework.

Enterprise Security indexes all risk as events in the risk index.

Score ranges for risk

Risk scoring offers a way to capture and aggregate the activities of an asset or identity into a single metric using risk modifiers.

The correlation searches included in Enterprise Security assign a risk score between 20 and 100 depending on the relative severity of the activity found in the correlation search. The searches scope the default scores to a practical range. This range does not represent an industry standard. Enterprise Security does not define an upper limit for the total risk score of an identity or asset, but operating systems can impose a limit. For example, 32-bit operating systems limit a risk score to two million.

Risk score levels use the same naming convention as event severity. You can assess relative risk scores by comparing hosts with similar roles and asset priority.

• 20 - Info
• 40 - Low
• 60 - Medium
• 80 - High
• 100 - Critical

Edit a correlation search to modify the risk score that the risk analysis response action assigns to an object. See Included adaptive response actions with Splunk Enterprise Security.

Managing risk objects

Enterprise Security associates risk modifiers with risk objects.

Risk object field

The risk object field is a reference to a search field returned by a correlation search. Correlation searches use fields such as src and dest to report on matching results. The risk object field represents a system, host, device, user, role, credential, or any object that the correlation search is designed to report on. Review any correlation search that assigns a risk score for examples of fields that receive a risk score.

Risk object types

Splunk Enterprise Security defines three risk object types.

Object type	Description
System	Network device or technology. Can represent a device in the asset lookup.
User	Network user, credential, or role. Can represent an identity in the identity lookup.
Other	Any undefined object that is represented as a field in a data source.

If a risk object matches an object in the asset or identity table, Enterprise Security maps the object as the associated type. For example, an object that matches an asset in the asset lookup is mapped to a risk object type of system. However, devices and users do not need to be represented in the corresponding asset and identity tables to be identified as system or user risk objects. ES categorizes undefined or experimental object types with a risk object type of Other.

Create a new risk object

1. From the Enterprise Security menu, select Configure > Data Enrichment > Lists and Lookups and select the Risk Object Types list.
2. Highlight the last risk_object_type cell in the table and right-click to see the table editor.
3. Insert a new row into the table.
4. Double-click in the new row to edit it, then add the new object type name.
5. Save the changes.

Edit an existing risk object

1. From the Enterprise Security menu, select Configure > Data Enrichment > Lists and Lookups
2. Select the Risk Object Types list.
3. Highlight the risk object type and change the name.
4. Save the changes.

Example of assigning a risk score through search

A correlation or other search can directly modify a risk score without using an alert. In this way, it can alter the risk score of a system or user based on the results of a search, rather than only when search results match a particular set of conditions.

For example, the Threat Activity Detected correlation search uses search-assigned risk in addition to an alert-type risk modifier. When the search finds an asset or identity communicating with a host that matches a configured threat list, the search modifies the risk score accordingly. In this case, the risk modifier reflects the number of times the system or user communicated with the threat list, multiplied by the weight of the threat list.

As a formula, risk score of a system or user + (threat list weight x event count) = additional risk.

As a more specific example, if a search detects host DPTHOT1 communicating with a host on a spyware threat list during a particular time period, the base risk score is set to 40. Then, because DPTHOT1 communicated with the host on the threat list twice, and the spyware threat list has a weight of one, the search modifies the risk score to a total risk score of 42.

See Risk Analysis Framework for more about assigning risk scores with search.