An error message "Failed to migrate the following ES detections" occurs after upgrading the Splunk Enterprise Security.

Applicability

Description

The below error message occurs in the messages tab after upgrading the Splunk Enterprise Security to 8.0.2.

"Failed to migrate the following ES detections: ['Threat - Risk Notable - Risk Threshold Exceeded For OT User Over 24 Hour Period - Rule']. Contact Splunk Support."

Investigation

Upon investigation, it was identified that the default searches from the "OT-Security" app failed to migrate properly following the upgrade to Splunk Enterprise Security version 8.0.2.

Additionally, it was observed that default risk modifiers are not automatically applied to event-based detections in Splunk Enterprise Security.

Below is the list of searches that were failed to migrate:

Endpoint - Activity from Outside Facility After Normal Work Hours - Rule

Threat - Risk Notable - Risk Threshold Exceeded For OT Asset Over 24 Hour Period - Rule

Threat - Risk Notable - Risk Threshold Exceeded For OT Facility Over 24 Hour Period - Rule

Threat - Risk Notable - Risk Threshold Exceeded For OT User Over 24 Hour Period - Rule

The following SPL command was used to identify the default searches that failed to migrate properly after the upgrade to Splunk Enterprise Security version 8.0.2.

| rest /servicesNS/-/-/saved/searches splunk_server=local count=0 | search action.risk.param._risk = "[]" OR action.risk.param._risk = "[{\"risk_object_field\":\"\",\"risk_object_type\":\"\",\"risk_score\":1}]" | table action.correlationsearch.label, action.risk.param._risk

Current configurations for the "action.risk.param._risk" is [{"risk_object_field":"","risk_object_type":"","risk_score":1}] . 

To align with the expected configuration format from previous valid rules, this needs to be updated manually in each saved search to set action.risk.param._risk explicitly to a null value represented as ""

Resolution

To resolve the issue, perform the below steps:

• Navigate to Settings > Searches, Reports and Alerts.
• Seach for the savedsearch "Endpoint - Activity from Outside Facility After Normal Work Hours - Rule" and click "edit" and select "advanced edit".

• Search for the parameter "action.risk.param._risk" and update the "risk_score" value to empty string ("").

Current configuration:

action.risk.param._risk = [{"risk_object_field":"","risk_object_type":"","risk_score":1}]

Updated configuration:

action.risk.param._risk = [{"risk_object_field":"","risk_object_type":"","risk_score":""}]

• Click "Save'.

Similarly, perform the above steps for the remaining savedsearches.

Related Links

Related Link: Troubleshoot Risk