Included adaptive response actions with Splunk Enterprise Security
Splunk Enterprise Security includes several adaptive response actions that you can run on a notable event from Incident Review.
- Modify a risk score with a risk modifier
- Start a stream capture with Splunk Stream
- Ping a host
- Run nbtstat
- Run nslookup
- Add threat intelligence
Note: ES admins can configure these and additional adaptive response actions to be triggered by correlation searches. See Configure adaptive response actions for a correlation search in Splunk Enterprise Security in Administer Splunk Enterprise Security.
Modify a risk score with a risk modifier
Modify a risk score as a result of a correlation search or in response to notable event details with the Risk Analysis adaptive response action. The risk adaptive response action creates a risk modifier event. You can view the risk modifier events on the Risk Analysis dashboard in Enterprise Security.
- Click Add New Response Action and select Risk Analysis.
- Type the score to assign to the risk object.
- Select a field from the notable event to apply the risk score to for the Risk Object Field.
- Select the Risk Object Type to apply the risk score to.
Run a script
Run a script stored in
- Click Add New Response Action and select Run a script.
- Type the filename of the script.
More information about scripted alerts can be found in the Splunk platform documentation.
- For Splunk Enterprise, see Configure scripted alerts in the Splunk Enterprise Alerting Manual.
- For Splunk Cloud, see Configure scripted alerts in the Splunk Cloud Alerting Manual.
Start a stream capture with Splunk Stream
Start a Stream capture to capture packets on the IP addresses of the selected protocols over the time period that you select. You can view the results of the capture session on the Protocol Intelligence dashboards.
A stream capture will not work unless you integrate Splunk Stream with Splunk Enterprise Security. See Splunk Stream integration.
- Click Add New Response Action and select Stream Capture to start a packet capture in response to a correlation search match.
- Type a Description to describe the stream created in response to the correlation search match.
- Type a Category to define the type of stream capture. You can view streams by category in Splunk Stream.
- Type the comma-separated event fields to search for IP addresses for the Stream capture. The first non-null field is used for the capture.
- Type the comma-separated list of protocols to capture.
- Select a Capture duration to define the length of the packet capture.
- Type a Stream capture limit to limit the number of stream captures started by the correlation search.
Ping a host
Determine whether a host is still active on the network by pinging the host.
- Click Add New Response Action and select Ping.
- Select the field that contains the host that you want to ping in the Host Field.
- Type the number of maximum results that the ping returns. Defaults to 1.
Learn more about a host and the services that the host runs by running nbtstat. You must have nbtstat installed on the search head for this to run successfully.
- Click Add New Response Action and select Nbtstat.
- Select the field that contains the host that you want to run the nbtstat for in the Host Field.
- Type the number of maximum results that the nbtstat returns. Defaults to 1.
Look up the domain name of an IP address, or the IP address of a domain name, by running nslookup. You must have nslookup installed on the search head for this to run.
- Click Add New Response Action and select Nslookup.
- Select the field that contains the host that you want to run the nslookup for in the Host Field.
- Type the number of maximum results that the nslookup returns. Defaults to 1.
Add threat intelligence
Create threat artifacts in a threat collection.
- Click Add New Response Action and select Add Threat Intelligence.
- Select the Threat Group to attribute this artifact to.
- Select the Threat Collection to add the threat artifact to.
- Select the Field from event that contains the value to add as a threat artifact to the threat intelligence collection.
- Type a Description for the threat artifact.
- Type a Weight associated with the threat list. Defaults to 1.
- Type a number of Max Results to specify the number of results to process as threat artifacts. Each unique search field value counts as a result. Defaults to 100.
Take action on a notable event on Incident Review in Splunk Enterprise Security
How urgency is assigned to notable events in Splunk Enterprise Security
This documentation applies to the following versions of Splunk® Enterprise Security: 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.3.0 Cloud only, 6.4.0, 6.4.1, 6.5.0 Cloud only, 6.5.1 Cloud only