Entity risk scoring in Splunk Enterprise Security

The Entity Risk Score (ERS) measures the overall risk level of an entity, such as a user or asset, based on findings associated with that entity. It's calculated over the past 7 days and normalized to a range of 0 to 100. The ERS uses a scheduled search called Risk - EWA Entity Risk Score Calculation to calculate risk scores for all entities that have at least one intermediate finding from the past 7 days. The search runs every 20 minutes by default.

CAUTION: Do not change or update the Risk - EWA Entity Risk Score Calculation saved search.

The ERS calculation begins by scaling each detection's contribution by an average of the following calibration multipliers:

  • detection_frequency_per_entity_multiplier​: A multiplier based on how often a specific detection fires for this particular entity. A detection that rarely fires for this entity has a higher multiplier value than one that fires more frequently.​

  • detection_frequency_per_stack_multiplier: A multiplier based on how often a detection fires across all entities in the environment; in other words, how much noise it makes throughout the environment. A detection that affects very few entities relative to the total population has a higher multiplier value than one that fires more broadly across many entities.

  • detection_quality_per_stack_multiplier : A multiplier based on each detection's True Positive and False positive rates in the notable index. A detection with a strong True Positive rate, relative to False Positives, has a higher multiplier value than one that fires more broadly across many entities.​

Next, the ERS calculates a weighted average of the following components for findings in the Risk Index:

  • The distinct number of detections observed for the entity.

  • The maximum adjusted risk score observed on any intermediate finding.

  • The number of intermediate findings with a risk score greater than 50.

  • The sum of risk across different detections, using the highest adjusted risk score from each detection.

  • The distinct number of MITRE tactics mapped from the detections observed for the entity.

Note: UEBA uses data from the Splunk Enterprise Security Risk Data Model. For best results, configure your correlation searches to include MITRE ATT&CK annotations, which improve detection accuracy and risk scoring.