How to assign Risk in Splunk Enterprise Security via correlation search

Applicability

Description

Creating a Correlation Search to generate a Notable event with a Risk object & a Risk score:

1. Apps → Enterprise Security

2. Configure → Content → Content Management. 

3. Within the Content Management Page select "Create New Content" → Correlation Search.

4. In the Search Name field use the following name;

5. Test Notable for Risk Score Aggregation

6. Use the following Search in the search field;

7. | makeresults count=1 annotate=true
   | addinfo
   | eval sid = $info_sid$
   | eval time=strftime(_time, "%b %d, %Y %I:%M:%S %p")
   | eval time2=strftime(_time, "%b %d %I:%M:%S %p")
   | eval st = strftime($info_search_time$, "%b %d, %Y %I:%M:%S %p")
   | eval result_generated="true"
   | eval notable_name="Test Notable for Risk score" + " on " + time2 + " with sid " + sid
   | eval custom_defined_rule_name="Test Notable for Risk Score Aggregation"
   | eval custom_defined_risk_object="Threat Instance - OS:Windows"
   | eval custom_defined_risk_score=500
   | fields - _time time
   | rename result_generated AS "Generated Status" notable_name AS Notable custom_defined_risk_object AS "Risk Object" custom_defined_rule_name As "Rule Name" custom_defined_risk_score AS "Risk Score" sid AS "Search ID" st AS "Search Time"
   | table "Rule Name" Notable "Generated Status" "Search Time" "Risk Object" "Risk Score" "Search ID"

8. For the Annotations, in MITRE  ATT&CK field use the following;

9. T1113, T1123, T1124

   You can use any annotations for MITRE ATT&CK, the above is an example to be used.

10. In the Cron Schedule field enter the following

11. */3 * * * *

12. Add a new Adaptive Response Action for a Notable

13. In the Title use the following title;

14. $Risk Object$ added to risk index with score 500

15. Add a new Adaptive Response Action for a Risk Analysis

16. Enter the below values for the fields on the Risk Analysis Adaptive Response Action.

17. Risk Messsage = $Risk Object$
    Risk Score = 350
    Risk Object Field = Risk Object
    Risk Object Type = system

18. Click Save on the bottom right corner of the Content Management page.