RBA Risk Notables

[ZachTheSplunker]

Question from "The Office" Hours

Any more ideas for risk notables beyond thresholds for risk score and # of tactics?

[ZachTheSplunker]

Answer from "The Office" Hours meetup

• # of Risk events - raw volume
• # of Risk Incident Rule Notables (incidents a human must work)
  • (default) 7 day ATT&CK Tactic Threshold Exceeded
  • (default) 24 hour Risk Threshold Exceeded
  • 24 hour ATT&CK Tactic Threshold Exceeded
  • 7 day Risk Threshold Exceeded
  • Anomalous risk score (priv user has > 2 stdDev than their peers)
  • Anomalous risk score with given asset_category
  • Anomalous score trend for given role (%'age increase)
  • Anomalous scoring trend for a given asset_category (%'age increase)
  • Anomalous scoring trend for threat_object_type
  • First time seen (6 months) threat_object observed across a small number of risk_objects
• Status, impact, and accuracy KPIs
• Mean time to resolution (MTTR)
• # of events triaged with SOAR
• # of events remediated with SOAR