What's new in the Splunk App for Splunk Attack Analyzer

This release of the Splunk App for Splunk Attack Analyzer includes the following enhancements.

What's New in 1.2.x

Table 1. What's new in 1.2.0
New Feature or Enhancement Description
Notable-generating searches for Jobs dataThree new correlation searches were added to the Splunk App for Splunk Attack Analyzer:
  • Threat - Splunk Attack Analyzer - High-scoring Job Detected
  • Threat - Splunk Attack Analyzer - Medium-scoring Job Detected
  • Threat - Splunk Attack Analyzer - Low-scoring Job Detected

These new correlation searches create notables with the name of "Threat - Splunk Attack Analyzer - Job Detected with Score of <display score> and Verdict of <verdict>" for every job that scores a certain amount in Splunk Attack Analyzer. Scores are on a 0 to 100 scale and are returned by the engine once the engine has completed analysis for a given resource. A score of 0 indicates no evidence of maliciousness, while a score of 100 indicates a high evidence of maliciousness. A score of 0-29 is a low-scoring job, 30-69 is a medium-scoring job, and 70-100 is a high-scoring job.

Note: These correlation searches are deactivated by default. To activate them, navigate to Splunk Enterprise Security, then Configure, then Content, then Content Management. Search for the correlation search you want to enable and select Activate/ Turn on.

What's new in 1.2.1

This release included no new features or enhancements. For a list of fixed issues, see Fixed Issues.