Splunk® Enterprise Security

Use Cases

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Assign risk scores to assets and identities

Using Splunk Enterprise Security, Ram assigns risk scores to the assets and identities in his network environment. The risk scores show the relative risk of a device or user in the network environment over time and creates an extra layer of security-enriched data. The risk scores help to exponentially increase the number of detections because they let Ram calculate the risk within his environment posed by small events over time. Ram now creates more meaningful and higher fidelity alerts, called risk notables, which increase visibility and reduce overall risk. The Risk Analysis dashboard displays these risk scores and other risk-related information. Enterprise Security indexes all risks as events in the risk index.

Ram can add risk scores to a user, a system, or an object in multiple ways:

  • Using a custom correlation search
  • Specifying risk as an adaptive response action from the Incident Review page
  • Adding an ad hoc risk entry from the Risk Analysis dashboard
  • Assigning risk through a search

Learn more

Create and adhoc risk entry.

Assign risk through a search

Last modified on 19 January, 2022
PREVIOUS
Isolate threats with risk alerting
  NEXT
Generate risk notables using correlation searches

This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters