Default risk factors in Splunk Enterprise Security

Use default risk factors designed for specific conditions to dynamically assign risk scores to risk objects and effectively isolate threats using Splunk Enterprise Security. Splunk Enterprise Security provides seven risk factors by default, which you can customize based on your specific environment. You can also use these default risk factors as examples for guidance and create your own risk factors based on your environment.

All risk factors available in Splunk Enterprise Security are displayed on the Risk factor Editor, but are in a disabled state.

Following is the list of risk factors that are available on the app by default:

Risk factor	Description
Admin User	Increases the risk score of a user who has a privileged or administrative identity. So, if the user_category field matches the regex value of "admin", the risk factor is multiplied by 1.5.
Contractor User	Increases the risk score for a user who is a contractor. So, if the user_category field value is "contractor", the risk score is increased by a sum of 5.
Critical Priority Destination	Increases the risk score for critical destinations. So, if the dest_priority field value is "critical", the risk factor is multiplied by 1.5.
High Priority User	Increases the risk score for high priority users. So, if the user_priority field value is "high", the risk factor is multiplied by 1.25.
PCI Source	Increases the risk for sources that are related to PCI compliance.
Watchlisted Priority User	Increases the risk score for users on a watch list when the user is not on a priority list. So, if the user_watchlist field is equal to "true" and the user_priority is not equal to "low", the risk factor is multiplied by 1.5. For more information on watchlists, see the Splunk Blogs post Using watchlists to your advantage.
Watchlisted User	Increases the risk score for users on a watch list by a multiple of 1.5. So, if the user_watchlist is "true", the risk factor is multiplied by 1.5. For more information on watchlists, see the Splunk Blogs post Using watchlists to your advantage.

See also

For more information about risk factors, see the product documentation.

Create risk factors in Splunk Enterprise Security

Manage risk factors in Splunk Enterprise Security

Troubleshoot upgrade issues with risk factors

Customizing risk factors by applying conditions to data fields