Leverage the supported detections to transform anomalies in the behavioral analytics service to risk notables in Splunk Enterprise Security. Converting these anomalies into risk events lets you avoid false positives but still address all potential risk within your security environment. You can also correlate the specific detections in behavioral analytics service with risk objects to set risk thresholds.

Risk factors defined in Splunk Enterprise Security adjust or weigh risk scores associated with specific risk objects based on certain conditions. The same entities in behavioral analytics service reflect the defined risk factors so that the entity risk levels are similar, even if the risk scores are on different scales. As a result, no duplicate notables get created when you leverage behavioral analytics service for risk detection within Splunk Enterprise Security. You can also identify the originating event that generated the risk event within Splunk Enterprise Security.

Notables generated by behavioral analytics service get sent through a pipeline into the risk index in Splunk Enterprise Security using the same Common information Model (CIM) field mappings. The field mappings provided in the following table indicate how the specific fields in behavioral analytics service detections get converted to risk events in Splunk Enterprise Security. Use these field correlations to make adjustments to risk factors and adjust the risk scores for events generated by the behavioral analytics service.

These field mappings conform to the fields in the Risk Analysis data model that describes the data generated by the risk framework in Splunk Enterprise Security. For more information on the fields in the Risk Analysis data model, see Risk Analysis data model fields.

To file a ticket on the Splunk Support Portal for help with field mappings, see Support and Services.