get_risk_for_endpoint.json

{
  "creation_date": "2017-10-14",
  "data_metadata": {
    "data_models": [
      "Risk"
    ],
    "data_source": [
      "Risk Scores"
    ],
    "providing_technologies": [
      "Splunk Enterprise Security"
    ]
  },
  "description": "For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk\\_scores, names of the correlation searches that contributed to create a risk score for a specific endpoint(machine\\_name) ",
  "entities": [
    "dest"
  ],
  "how_to_implement": "Enable the correlation searches included in Splunk Enterprise Security that include Risk Analysis alert actions by leveraging the Risk Analysis Framework",
  "id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
  "investigate": {
    "splunk": {
      "fields_required": [
        "dest"
      ],
      "schedule": {
        "cron_schedule": "",
        "earliest_time": "604800",
        "latest_time": "0"
      },
      "search": "| from datamodel:Risk.All_Risk | search risk_object_type=system risk_object={dest} | stats count sum(risk_score) as risk_score values(search_name)  min(_time) as firstTime max(_time) as lastTime by risk_object | `ctime(firstTime)` | `ctime(lastTime)`"
    }
  },
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2017-10-19",
  "name": "Get Risk Modifiers For Endpoint",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "spec_version": 2,
  "type": "splunk",
  "version": "1.0"
}