Create event-based detections in Splunk Enterprise Security

Specify whether you want to create intermediate findings or findings using your event-based detection. You can also customize the display of intermediate findings and findings in the analyst queue on the Mission Control page by defining the specific fields associated with them.

Follow these steps to specify the output type that you want to create using event-based detections:

1. In the detection editor, go to Analyst queue information.
2. In Output, select whether you want to create findings or intermediate findings or both. You can also add the criteria to specify the display the findings and intermediate findings in the Analyst queue on the Mission Control page by specifying values for associated fields.

Create intermediate findings using event-based detections

You can use event-based detections to create intermediate findings that are low fidelity security alerts that signify suspicious activity but aren't full incidents and serve as building blocks that feed into higher-fidelity, aggregated findings.

1. In Output, select Create intermediate findings to create intermediate findings
2. Add a Risk message for the intermediate finding that is descriptive, concise, and provides context to help analysts understand what occurred before it is aggregated into a larger threat story. For example, Risk event for $risk_object_type$ $risk_object$ detected.
3. In Intermediate finding score, specify a risk score for the intermediate finding.
4. In Entity, specify an entity and a finding score for it. For example, the name to refer to an user, host, endpoint, server, domain, device, or IP address that can be assigned a risk score to track potential threats.
5. In Entity type, specify an entity type. For example, a user, system or a custom entity type.
6. Select +Add entity to add more entities and their associate scores and types.

Create findings using event-based detections

1. In Output, select Create findings to create findings.
2. Use the table to specify how to the display the findings in the Analyst queue on the Mission Control page.

   Field	Description	Required?
   Finding name	Name of the finding.	Yes
   Description	Information on the finding.	Yes
   Entity	Information on the user, host, endpoint, server, domain, device, or IP address that can be assigned a risk score, entity name, entity type, to track potential threats.	No
   Investigation type	Allows you to associate an investigation type that is pre-defined in the Findings and Investigations configuration section when configuring a detection. When a finding is created from the detection and transitions to an Investigation, the Investigation type assigned here is assigned to the investigation.	Yes
   Severity	Value assigned to a finding, which when combined with the priority of an entity helps to generate the urgency of an event.	Yes
   Default owner	Tracks who is working on the finding but it starts blank, often with a 'New' status, until an analyst takes action.	No
   Default status	Tracks the lifecycle of the finding from New, In progress, Pending, Resolved, or Closed	No
   Next steps	Drop-down list of adaptive response actions. For example, Stream Capture, Nbstat, and so on.	No
   Recommended actions	List of recommended adaptive response action that you can select to run when specific findings are generated. For example, Add events to an investigation.	No

Optionally, you can add observables or indicators of compromise (IOCs) such as a URL, file hash, or email address or entities such as IPs, domains, file hashes to your detection if they pose an increased security risk to your environment. Adding threat objects to detections allows you to enrich them with threat intelligence and link them to a broader risk context so that findings can be transformed into actionable insights by tagging them with known bad indicators.

1. In the detection editor for event based detections, go to Threat objects.
2. Select +Add threat object.
3. In Threat object field, enter a value that represents an observable threat in your search results. For example, a domain name, IP address, file hash, command line, or process name.
4. In Threat object type, enter the category of the threat object such as domain, ip_address, file_hash, user.

Configure trigger conditions to control when an event-based detection generates intermediate findings or findings. After you define trigger conditions, the detection search results check if they match the conditions. If the detection search results match the conditions, then intermediate findings or findings are generated.

For information on trigger conditions and configuring those conditions for a detection, see the following Splunk platform documentation:

• For Splunk Enterprise, see Configure alert trigger conditions in the Splunk Enterprise Alerting Manual.
• For Splunk Cloud Platform, see Configure alert trigger conditions in the Splunk Cloud Platform Alerting Manual.

Follow these steps to configure conditions to trigger the appropriate number of findings in event-based detections:

1. In the Detection editor, scroll down to the section on Conditions
2. In the Create when field, specify the condition to create intermediate findings or findings by selecting from one of the following options: Number of results, Number of hosts, Number of sources, Custom.
3. Select one of two options: Once or For each result. After the event pattern occurs, the alert can trigger just once or one time for each result in the pattern. You can choose an option depending on the notification or other alert action behavior that you want. However, selecting either of the options does not impact the finding adaptive response actions, such as Send email.
   For Send email, if you select Once as the trigger frequency option, you trigger the alert only once for each time the search results match the specified condition and receive a single notification in your inbox. If you select For each result, you trigger multiple notifications but with the same number of findings. Trigger condition for Send Email is an exception and does not impact the total number of findings that are generated. Even if you receive multiple email notifications, many of the findings might be duplicates.

Set up throttling to limit the number of adaptive response actions generated by a detection. When a detection matches an event, it triggers an adaptive response action.

By default, every result returned by the detection generates an adaptive response action. Typically, you might want only one alert of a certain type. You can use throttling to prevent a detection from creating more than one alert within a set period. To change the types of results that generate an adaptive response action, define trigger conditions. Some adaptive response actions allow you to specify a maximum number of results in addition to throttling.

Follow these steps to throttle the number of adaptive response actions generated by a detection:

1. In Splunk Enterprise Security, select Configure.
2. Select Content, and then select Content management.
3. Select the title of the detection you want to edit.
4. Enter a Window duration. During this window, if an event value matches all of the Fields to group by the detection does not create an alert. After the window ends, the next matching event creates a new alert and applies the throttle conditions again.
5. Enter the Fields to group by to specify which fields to use when matching similar events. If an event matches all the fields listed here, the detection does not create a new alert. You can define multiple fields. Available fields depend on the search fields that the detection returns.
6. Save the detection.

Throttling applies to any type of detection adaptive response action and occurs before finding suppression rules.

If you have throttling set for an existing detection, editing the details of the alert or the throttle configuration resets the throttling. This includes any changes to fields you throttle on, the SPL in the detection, the cron schedule, and so on. The change causes the throttle file, which notes how long to ignore events, to be removed. Therefore, the throttling does not occur until the next event triggers based on the new parameters.

When detection versioning is turned on, any change that is made to a detection is saved as a new version and that new version is not automatically turned on. This is because the previous version of the detection is still turned on until the detection engineer turns on the new version. Turning on the detection also resets throttling.

For more information on how to use and configure detections in Splunk Enterprise Security, see the product documentation:

• Run adaptive response actions in SPlunk Enterprise Security
• Add annotations in Splunk Enterprise Security
• Investigate findings using drill-down searches in Splunk Enterprise Security
• Use detections to search for behavioral patterns in Splunk Enterprise Security
• Create finding-based detections in Splunk Enterprise Security
• Use detection versioning in Splunk Enterprise Security
• Suppress specific detections or fields in Splunk Enterprise Security
• Configure automation rules to run playbooks based on detections