Research
E-BOOK
The Essential Guide to
Risk Based Alerting
RBA uses the existing Splunk Enterprise Security (ES) correlation rule framework to collect interesting and potentially risky events into a single index with a shared language, which is then used for alerting. Events collected in the Risk Index produce a single Risk Notable only when certain criteria warranting an investigation are met, which means increased visibility and closing gaps while reducing the volume of low fidelity alerts. This process transforms traditional alerts into potentially interesting observations which correlate into a high-fidelity security story for analysts to investigate.
Fill out this form to download