Collection: splunk.es, module: splunk_adaptive_response_risk_analysis_events

[githubmagu]

SUMMARY

This functionality would allow to programatically manage risk objects defined within a correlation search. Currently this is not supported at all.

Risk based Alerting information:
https://lantern.splunk.com/Security/UCE/Guided_Insights/Risk-based_alerting/Implementing_risk-based_alerting

ISSUE TYPE

• Feature Idea

COMPONENT NAME

New module: splunk_adaptive_response_risk_analysis_events

ADDITIONAL INFORMATION

Usage: exactly the same as other modules from this collection but using different fields / data structures

      - name: Add adaptive response risk analysis events config
        splunk.es.splunk_adaptive_response_risk_analysis_events:
          config:
            - correlation_search_name: "{{ correlation_search }}"
              name: "{{ risk_message_title }}"
              description: "{{ correlation_search_description }}"
              risk_modifiers:
                risk_objects:
                  - risk_object_field: value11
                    risk_object_type: value12 
                    risk_object_score: value13
                  - risk_object_field: value21 
                    risk_object_type: value22
                    risk_object_score: value23
                   [...]
                threat_objects:
                  - threat_object_field: value31 
                    threat_object_type: value32
                  - threat object_field: value41
                    threat_object_type: value42
                   [...]
          state: merged

N/A