Modifying risk incident rules based on the search results
Modify the risk incident rules based on the search results prior to deploying risk-based alerting in a production environment.
Initially, RBA might lead to more alerts. While this seems counter-intuitive, it helps you to improve the risk index and fine tune alerts. As an analyst, you must invest time to curate your risk index and identify how to customize RBA to your unique needs over time.
You can assign a low risk score to the risk incident rule, so that it rarely generates alerts if you determine that it represents a low threat. The risk scores associated with assets and identities represent only a single component within the detection process and the risk notable searches that the analyst tunes based on prior experience and knowledge helps to construct stories that can detect threats, prioritize investigations, run adversary simulations, and define threat hunting perspectives.
See also
Configure correlation searches in Splunk Enterprise Security
| Customizing risk factors by applying conditions to data fields | Suppressing false positives using alert throttling |
This documentation applies to the following versions of Splunk® Enterprise Security: 7.1.0, 7.1.1, 7.1.2, 7.2.0, 7.3.0, 7.3.1, 7.3.2
Download manual
Feedback submitted, thanks!