This is the fifth step in the Isolate user behaviors that pose threats with risk-based alerting scenario.

Ram can also use the Risk Analysis dashboard to display any recent changes to risk scores associated with high risk users and monitor users who have the highest risk scores.

Ram uses the Risk Object filter on the Risk Analysis dashboard to monitor high risk users. Ram scrolls to the panel for Risk Score By Object to drill down on the users with the highest risk score and monitor their behavior over time.

Alternatively, you can also build your own dashboards to monitor risk activity and fit your use case in Splunk Enterprise Security.