Splunk Enterprise Security

Assign Risk in Correlation Search

panovattack
Communicator

We are trying to integrate the risk analysis framework in our incident response process.

We have developed a library of correlation searches where the results produce multiple objects upon which we need to assign risk, e.g. src, dest, users. When we and the "| sendalert risk" components to the correlation searches, notable events no longer generate and risk scores are NOT applied. When we run the searches as ad-hoc, the risk scores are properly assigned and the results appear as expected.

Can "| sendalert" not appear in a correlation search? The Risk Analysis Adaptive response action is not sufficient, as we can not dynamically set the risk tolerance, nor set risk against multiple objects with that action.

e.g: | eval risk_score=case(severity=="critical", 20, severity=="high", 15, severity=="medium", 10, severity=="low", 5

0 Karma

kchamplin_splun
Splunk Employee
Splunk Employee

There are these examples in docs:
http://docs.splunk.com/Documentation/ES/5.2.0/User/RiskScoring
The appendpipe option is pretty good, but that said multiple | sendalerts should be supported as well - what version of ES are you on?

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee
0 Karma

panovattack
Communicator

The approach here does not seem to work when it comes to a correlation search. Multiple | sendalerts work in ad-hoc, but not when run as part of a correlation search.

0 Karma

panovattack
Communicator

Just an update that we are waiting for a Splunk and ES upgrade to see if that fixes the issue. We'd like to be able to dynamically assign risk to multiple objects in a single correlation search.

0 Karma

panovattack
Communicator

Still can't seem to figure it out after upgrade. Is there anyway to reliably assign risk to multiple objects from a correlation search or a saved search? Or is the limit one?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I'm adding a score to several objects from one event from a saved search

I do this

| eval risk_object=mvappend(field_1."|system",field_2."|user",field_3."|user",field_4."|other")
| eval risk_score=1
| mvexpand risk_object
| eval x=split(risk_object, "|")
| eval risk_object=mvindex(x, 0, 0), risk_object_type=mvindex(x,1,1)
| fields - x

and then sendalert at the end, so for each event, I get 4 events.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...