Part 5: Review risk notables for triaging

Now, you can review some risk notables that gets generated by the default risk incident rules in Splunk Enterprise Security. Reviewing risk notables by drilling down on them using the Risk Event Timeline visualizations helps to triage and identify the risk notables that require further investigation.

Following are the default risk incident rules available in Splunk Enterprise Security:

• Att&CK Tactic Threshold Exceeded For Object Over Previous 7 days
• Risk Threshold Exceeded For Object Over 24 Hour Period

Review risk notables

Follow these steps to review risk notables generated by the default risk incident rules available in Splunk Enterprise Security:

1. In Splunk Enterprise Security, select Configure, then select Content.
2. Select Content Management.
3. In Type, select Correlation Search.
4. In App, select SA-ThreatIntelligence.
5. Select the default risk incident rule Risk Threshold Exceeded For Object Over 24 Hour Period to open it in the Correlation Search Editor.
6. From the Correlation Search Editor, copy the SPL search associated with this risk incident rule and paste it in the Search bar to review the results.
   

   | tstats `summariesonly` mode(All_Risk.risk_object) as risk_object, sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count,values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count, values(All_Risk.risk_object) as all_risk_objects, values(All_Risk.cim_entity_zone) as cim_entity_zone from datamodel=Risk.All_Risk by All_Risk.normalized_risk_object,All_Risk.risk_object_type | `drop_dm_object_name("All_Risk")` | eval "annotations.mitre_attack"='annotations.mitre_attack.mitre_technique_id', risk_threshold=100 | where risk_score > $risk_threshold$ | `get_risk_severity(risk_score)`

   You might find a few risk objects that might be worth investigating further due to their high risk score, risk event count, and the number of MITRE tactics associated with them.

Use Incident Review for additional context to triage incidents effectively

Follow these steps to triage incidents using the Incident Review page:

1. In Splunk Enterprise Security, select Incident Review to display the list of risk notables.
2. Expand the risk notable for additional context such as MITRE tactic and technique, associated risk objects, risk object priority, and risk score, and so on.
3. Under Contributing Events, select View the individual Risk Attributions to drill down into the risk index.

   If you want to display additional context, you can add more columns to search the risk index by modifying the drill-down search in the '''Adaptive Response Action''' of the Correlation Search Editor.

   
   Following is an example of what the search results look like with the improved drill-down: The risk message in the table provides additional information that might be helpful for triaging.

Use the Risk Event timeline to drill down on risk events

Now, you can explore the risk notables generated by the default risk incident rule in the Risk Event Timeline visualization and sort them by time to review threat objects.

Follow these steps to examine the risk notables using the Risk Event Timeline:

1. In Splunk Enterprise Security, go to Incident Review and select the drop down arrow next to the risk object in the Actions column.
2. Select Risk Event Timeline.
3. Review the timeline visualization to sort the contributing risk events by time and review the associated threat objects.

See also

For more information on the Risk Event Timeline visualization, see the product documentation:

• Default risk incident rules in Splunk Enterprise Security
• Review risk notables to identify risk in Splunk Enterprise Security

Next step

Now that you have reviewed a risk notable that might indicate threat, you can explore how to Suppress risk notables that are harmless.