Building a Risk-Based Secure Network Analytics Detection with Splunk Detection Editor (Alpha)

Building a detection usually involves more than writing a search. You need to understand the data, test the detection logic, normalize fields, decide how analysts will see the results, configure risk, and provide a path for further investigation.

Those tasks can require moving between several different parts of Splunk. While developing a detection for Cisco Secure Network Analytics (SNA), I used the Splunk Detection Editor (Alpha) to bring much of that workflow into one place.

Our goal was to take active SNA alarms, associate them with the source systems responsible for the activity, and add that information to the Splunk Enterprise Security risk index. Along the way, we used the editor to develop and test the SPL, associate sample data with the detection, configure risk scoring, reference CIM fields, and create an investigation drilldown.

Why use risk-based alerting?

A traditional detection can create an analyst-facing alert every time its search conditions are met. This works…