Create risk and edit risk objects in Splunk Enterprise Security

As a Splunk Enterprise Security administrator, you can create and edit risk objects to categorize anything to which you assigned a risk score. For example, you might categorize a laptop as a "system" risk object type and an identity as a "user" risk object type.

Create a new risk object

Follow these steps to create a new risk object:

  1. In Splunk Enterprise Security, select Configure > Content > Content Management.
  2. From the Type drop-down list, select Managed Lookup.
  3. (Optional) In the Search filter, enter risk object types.
  4. Select the Risk Object Types list.
  5. Highlight and select the last risk_object_type cell in the table to see the table editor.
  6. Insert a new row into the table.
  7. Double-click in the new row to edit it, then add the new object type name.
  8. Save the changes.

Edit an existing risk object

Follow these steps to edit a risk object:

  1. In Splunk Enterprise Security, select Configure > Content > Content Management.
  2. From the Type drop-down list, select Managed Lookup.
  3. (Optional) In the Search filter, enter risk object types.
  4. Select the Risk Object Types list.
  5. Highlight and select the risk object type and change the name.
  6. Save the changes.