Adjust risk scores for specific objects

This is the final step in the Isolate threats with risk-based alerting scenario.

Ram uses risk factors to adjust risk scores for specific risk objects to more effectively map out the risk in the security environment and simplify the threat investigation process to prioritize suspicious behavior. Risk factors increase the risk scores based on specific conditions without creating new searches. For example, Ram can increase the risk score by a factor of two on a laptop that might be a target if it belongs to a director instead of an individual contributor.

Risk factors get calculated based on a formula.

Ram can also use the default risk factors designed for specific conditions to dynamically assign risk scores to risk objects and isolate threats using Splunk Enterprise Security. Splunk Enterprise Security provides seven risk factors by default, which can be customized based on Ram's specific environment. Ram can also use these default risk factors as examples for guidance and create risk factors based on the environment.

1. Ram can modify the score of a risk object based on tactic, user, src, dest, and threat object.
2. From the Enterprise Security menu, Ram selects Configure > Content > Content Management.
3. From the Create New Content list, Ram selects Risk Factor, which opens the Risk Factor Editor.
4. Ram then selects the default risk factor, Watchlisted User.

The Watchlisted User risk factor increases the risk score for users on a watch list by a multiple of 1.5. So, if user_watchlist is true, the risk factor gets increased by a multiple of 1.5. Ram can include all the directors on the watchlist.

Now Ram can mitigate risk successfully by using risk factors that dynamically modify risk scores based on specific conditions and keep Buttercup Games safe from security threats.

See also

For more information on risk scores, see the product documentation:

How the risk factor scoring works

Create risk factors in Splunk Enterprise Security

Using Watchlists to Your Advantage blog post