Assign risk scores to high risk users

This is the second step in the Isolate user behaviors that pose threats with risk-based alerting scenario.

After Ram escalates the investigation, Ram sets an average risk score associated with risk events and maps this average risk score against the standard deviation to compare the risk scores of high risk users with other users.

Ram makes this comparison as follows:

1. First, Ram uses the eventstats command to generate summary statistics from fields in the events and saves those statistics into a new field.

   | eventstats avg (risk_score) as avg_risk stdev (risk_score) as stdev_risk

   However, Ram wants to add context to the risk scores for accurate risk evaluation.

2. Then, Ram wants to modify the risk scores based on the specific requirements of his network environment and high risk user profile.

Next step

Modify risk scores using the where command

See also

For more information on the eventstats command, see the product documentation:

The eventstats command in the Splunk Cloud Services SPL2 Search Reference.