Investigate risk notables using Threat Topology visualization

This is the last step in the Isolate user behaviors that pose threats with risk-based alerting scenario.

During an investigation, Ram also uses the Threat Topology visualization in Splunk Enterprise Security to isolate high risk users and identify how their behaviors might relate to each other by following these steps:

1. From the Splunk Enterprise Security menu bar, Ram clicks the Incident Review page.
2. Ram filters notables by "risk" Type to display all the risk notables.
3. Ram selects the number of risk events in the Risk Events column for the risk notable 24 hour Risk Threshold Exceeded by Privileged User.
4. Ram selects the Threat Topology option to display the connections between the risk events associated with the risk notable.
5. Ram selects on risk objects to highlight the related risk objects or threat objects and displays details such as MITRE information, risk scores, priority, and so on.
6. Ram also expands the risk notable to list the artifacts or risk objects associated with the risk notable.
7. Ram selects Investigate all artifacts to display more context on the artifacts associated with the investigation such as Risk Scores, Related Notables, Notable Events, and System Vulnerabilities.

Using the Threat Topology visualization, Ram identifies how multiple risk objects point to a single threat object. This makes the risk notable more meaningful for Ram and helps to investigate why a specific threat is persisting across a group of risk objects and drill down into the issue.