How to assign risk in Splunk Enterprise Security
You can assign or modify risk to an object using the following methods:
- Create a risk analysis response action or risk modifier
- Use a correlation search
You can dynamically assign risk scores based on the event types so that you can identify evolving threats in your security environment.
For example, you can assign a risk score of 0 to successful HTTP POST events that indicate the client's request was successfully received, understood, and accepted. You can assign a risk score of 20 for failed HTTP POST events as they are actions that were not performed. Similarly, you can assign a lower risk score to commands such as systeminfo, ipconfig, or netstat issues from a user account from another user's computer but still track them as a possible malicious event that might later become a risk notable.
Assign a risk score
To assign risk using Splunk Enterprise Security, choose one of the following methods:
- Modify risk scores. See Modify a risk score with a risk modifier in Splunk Enterprise Security
- Create an ad hoc risk entry from the Risk Analysis dashboard. See Create an ad hoc risk entry in Splunk Enterprise Security
- Assign risk through a search. See Assign risk through a search in Splunk Enterprise Security.
See also
For more information about how best to use RBA in your security environment, see the product documentation.