Splunk Enterprise Security

Tuning Risk Scores and resetting score values

sheamus69
Communicator

Hi,

I'm in the process of tuning our risk scores, as applied to objects (users or assets) from a correlation search.

What I'm uncertain about is, once I have configured the scoring in a manner that I am happy with, can I reset all the scores currently applied to objects so as to operate from a fresh start? The existing risk scores, being poorly configured, would presumably skew any risk analysis results going forward?

Any advice given here would be gratefully recieved.

Sheamus.

Edit:

This question is for Splunk Enterprise Security 4.0.1.

0 Karma
1 Solution

sheamus69
Communicator

OK, I think I've figured this out for myself.

Splunk doesnt need to baseline the scores, as the scores are calculated for a given timeframe. So a systems risk score would give a different value when looked a over 24 hours as opposed to over 7 days.

This effectively means that old risk values will drop out over time - which should reflect the fact that risk factors would, hopefully, get rectified once identified.

View solution in original post

0 Karma

sheamus69
Communicator

OK, I think I've figured this out for myself.

Splunk doesnt need to baseline the scores, as the scores are calculated for a given timeframe. So a systems risk score would give a different value when looked a over 24 hours as opposed to over 7 days.

This effectively means that old risk values will drop out over time - which should reflect the fact that risk factors would, hopefully, get rectified once identified.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Is this question for splunk enterprise security?

sheamus69
Communicator

Yes, Splunk ES 4.0.1. Apologies, should have given that information.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...