Assign risk scores to assets and identities

Using Splunk Enterprise Security, Ram assigns risk scores to the assets and identities in his network environment. The risk scores show the relative risk of a device or user in the network environment over time and creates an extra layer of security-enriched data. The risk scores help to exponentially increase the number of detections because they let Ram calculate the risk within his environment posed by small events over time. Ram now creates more meaningful and higher fidelity alerts, called risk notables, which increase visibility and reduce overall risk. The Risk Analysis dashboard displays these risk scores and other risk-related information. Enterprise Security indexes all risks as events in the risk index.

Ram can add risk scores to a user, a system, or an object in multiple ways:

• Using a custom correlation search
• Specifying risk as an adaptive response action from the Incident Review page
• Adding an ad hoc risk entry from the Risk Analysis dashboard
• Assigning risk through a search

Learn more

Create and adhoc risk entry.

Assign risk through a search