Entity risk scoring in Splunk Enterprise Security

The Entity Risk Score (ERS) measures the overall risk level of an entity, such as a user or asset, based on findings associated with that entity. It's calculated over the past 7 days and normalized to a range of 0 to 100. The ERS uses a scheduled search called Risk - EWA Entity Risk Score Calculation to calculate risk scores for all entities that have at least one intermediate finding from the past 7 days. The search runs every 20 minutes by default.

The ERS calculation begins by scaling each detection's contribution by an average of the following calibration multipliers:

• detection_frequency_per_entity_multiplier​: A multiplier based on how often a specific detection fires for this particular entity. A detection that rarely fires for this entity has a higher multiplier value than one that fires more frequently.​

• detection_frequency_per_stack_multiplier: A multiplier based on how often a detection fires across all entities in the environment; in other words, how much noise it makes throughout the environment. A detection that affects very few entities relative to the total population has a higher multiplier value than one that fires more broadly across many entities.

• detection_quality_per_stack_multiplier : A multiplier based on each detection's True Positive and False positive rates in the notable index. A detection with a strong True Positive rate, relative to False Positives, has a higher multiplier value than one that fires more broadly across many entities.​

Next, the ERS calculates a weighted average of the following components for findings in the Risk Index:

• The sum of all calculated_risk_score values across intermediate findings

• The maximum calculated_risk_score observed on any intermediate finding

• The number of intermediate findings with a calculated_risk_score ≥ 50

• The total count of intermediate findings

• The sum of risk across different detections, utilizing the highest risk score from each detection.