Managing Incident Review in Splunk Enterprise Security

detects patterns in your data and automatically reviews events for security-relevant incidents using correlation searches. When a correlation search detects a suspicious pattern, the correlation search creates an alert called a notable event.

The Incident Review dashboard surfaces all notable events, and categorizes them by potential severity so analysts can quickly triage, assign, and track issues.

• For information about how analysts use the Incident Review dashboard, see Incident Review overview in Use Splunk Enterprise Security.
• To audit and review analyst activity on the Incident Review dashboard, see Incident Review Audit in Use Splunk Enterprise Security.
• To customize the display of the Incident Review dashboard, and also modify analyst capabilities and permissions, see Customize Incident Review in Splunk Enterprise Security.
• To manually create notable events, see Manually create a notable event in Splunk Enterprise Security.
• To customize settings for notable events, see Customize notable event settings in Splunk Enterprise Security.
• For more information about how notable events are populated and managed by the notable event framework, see Notable Event framework in Splunk Enterprise Security on the Splunk developer portal.

How risk scores display in Incident Review

Risk scores do not display in Incident Review for every asset or identity. Only assets or identities (risk objects) that have a risk score and a risk object type of "system," "user," or "other" display in Incident Review. Risk scores only show for the following fields: orig_host, dvc, src, dest, src_user, and user. The risk score for an asset or identity might not match the score on the Risk Analysis dashboard. The risk score is a cumulative score for an asset or identity, rather than a score specific to an exact username.

• For example, if a person has a username of "buttercup" that has a risk score of 40, and an email address of "buttercup@splunk.com" with a risk score of 60, and the identity lookup identifies that "buttercup" and "buttercup@splunk.com" belong to the same person, a risk score of 100 displays on Incident Review for both "buttercup" and "buttercup@splunk.com" accounts.
• As another example, if an IP of 10.11.36.1 has a risk score of 80 and an IP of 10.11.36.19 has a risk score of 30, and the asset lookup identifies that a range of IPs "10.11.36.1 - 10.11.36.19" belong to the same asset, a risk score of 110 displays on Incident Review for both "10.11.36.1" and "10.11.36.19" IP addresses.

Risk scores are calculated for Incident Review using the Threat - Risk Correlation By <type> - Lookup Gen lookup generation searches. The searches are run every 30 minutes and focus on the last 7 days of risk events to update the risk_correlation_lookup lookup file. To see more frequent updates to the risk scores in Incident Review, update the cron_schedule of the saved searches.

Notify an analyst of untriaged notable events

You can use a correlation search to notify an analyst if a notable event has not been triaged.

1. Select Configure > Content > Content Management.
2. Locate the Untriaged Notable Events correlation search using the filters.
3. Modify the search, changing the notable event owner or status fields as desired.
4. Set the desired alert action.
5. Save the changes.
6. Enable the Untriaged Notable Events correlation search.