-
Notifications
You must be signed in to change notification settings - Fork 377
/
Copy pathget_risk_for_user.json
52 lines (52 loc) · 1.58 KB
/
get_risk_for_user.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
{
"creation_date": "2017-10-14",
"data_metadata": {
"data_models": [
"Risk"
],
"data_source": [
"Risk Scores"
],
"providing_technologies": [
"Splunk Enterprise Security"
]
},
"description": "For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk_scores, names of the correlation searches that contributed to create a risk score for a specific user ",
"entities": [
"user"
],
"how_to_implement": "Enable the correlation searches included in Splunk Enterprise Security that include Risk Analysis alert actions by leveraging the Risk Analysis Framework",
"id": "fdcfb369-1725-4c24-824a-22972d7f0d55",
"investigate": {
"splunk": {
"fields_required": [
"user"
],
"schedule": {
"cron_schedule": "",
"earliest_time": "604800",
"latest_time": "0"
},
"search": "| from datamodel:Risk.All_Risk | search risk_object_type=user risk_object={user} | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)` "
}
},
"maintainers": [
{
"company": "Splunk",
"email": "bpatel@splunk.com",
"name": "Bhavin Patel"
}
],
"modification_date": "2017-10-19",
"name": "Get Risk Modifiers For User",
"original_authors": [
{
"company": "Splunk",
"email": "bpatel@splunk.com",
"name": "Bhavin Patel"
}
],
"spec_version": 2,
"type": "splunk",
"version": "1.0"
}