Search for an entity's risk score history from Splunk Mission Control

You can view the risk score history for any entity by querying the ueba_cloud_risk_score_events index from Splunk Mission Control. As a compliance auditor or threat hunter, you can use this information to view specific events that caused changes to the entity's risk score over any period of time.

Perform the following steps to view the entity risk score history:

1. Click Search in the Splunk Mission Control menu bar.
2. In the search field, enter the desired search:

The following example search returns the entity risk score history for a device named host101:

| from ueba_cloud_risk_score_events | where entityPrimaryArtifact="host101"

The following example search returns the risk score events with the last 10 minutes:

| from ueba_cloud_risk_score_events | where earliest=-10m AND latest="now"

See Search in Splunk Mission Control in the Triage and Respond to Notables in Splunk Mission Control manual for more information about using search in Splunk Mission Control.