Splunk® Enterprise Security

Use Cases

This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.

Adjust risk scores for specific objects

Ram uses risk factors to adjust risk scores for specific risk objects to more effectively map out the risk in his security environment and simplify the threat investigation process to prioritize suspicious behavior. Risk factors increase the risk scores based on specific conditions without creating new searches. For example, Ram can increase the risk score by a factor of two on a laptop that might be targeted if it belongs to a director instead of an employee. Risk factors are calculated based on a formula.


Ram can also use the default risk factors designed for specific conditions to dynamically assign risk scores to risk objects and effectively isolate threats using Splunk Enterprise Security. Splunk Enterprise Security provides seven risk factors by default, which can be further customized based on Ram's specific environment. Ram can also use these default risk factors as examples for guidance and create his own risk factors based on his environment.

  1. Ram can modify the score of a risk object based on tactic, user, src, dest, and threat object.
  2. From the Enterprise Security menu, Ram selects Configure > Content > Content Management.
  3. From the Create New Content drop-down list, Ram selects Risk Factor, which opens the Risk Factor Editor.
  4. Ram then clicks the default risk factor, Watchlisted User.

EditCorrelationSearchWindow
This default risk factor increases the risk score for users on a watch list by a multiple of 1.5. So, if user_watchlist is true, the risk factor is increased by a multiple of 1.5. Ram can include all the directors on the watchlist. Now Ram is able to mitigate risk successfully by using risk factors that dynamically modify risk scores based on specific conditions and keep Buttercup Games safe from security threats.

See also

Last modified on 02 February, 2023
 

This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1, 7.0.2, 7.1.0, 7.1.1, 7.2.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters