-
Notifications
You must be signed in to change notification settings - Fork 12
RBA Risk Notables #33
Unanswered
ZachTheSplunker
asked this question in
Q&A
Question from "The Office" Hours
Any more ideas for risk notables beyond thresholds for risk score and # of tactics?
All reactions
Replies: 1 comment
Answer from "The Office" Hours meetup
- # of Risk events - raw volume
- # of Risk Incident Rule Notables (incidents a human must work)
- (default) 7 day ATT&CK Tactic Threshold Exceeded
- (default) 24 hour Risk Threshold Exceeded
- 24 hour ATT&CK Tactic Threshold Exceeded
- 7 day Risk Threshold Exceeded
- Anomalous risk score (priv user has > 2 stdDev than their peers)
- Anomalous risk score with given asset_category
- Anomalous score trend for given role (%'age increase)
- Anomalous scoring trend for a given asset_category (%'age increase)
- Anomalous scoring trend for threat_object_type
- First time seen (6 months) threat_object observed across a small number of risk_objects
- Status, impact, and accuracy KPIs
- Mean time to resolution (MTTR)
- # of events triaged with SOAR
- # of events remediated with SOAR
All reactions
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment