Splunk Security: Risk-Based Alerting Executive Briefing

Security threats are a business problem – everyone’s impacted. Security teams are overwhelmed by alert volume, have disconnected tools, and can be challenged to respond to what’s important to the business at that moment. Cybersecurity and business requirements must be aligned to enable fast, intelligent understanding of high-risk events and the potential impact to the business.

Splunk Enterprise Security 6.6 introduced the Risk-Based Alerting (RBA) feature, which enables efficient incident response and risk scoring frameworks enabling security teams to quickly assess and appropriately respond to threats. Threats to the business can be quickly identified, prioritized, addressed, and remediated.

This discussion will provide recommendations and best practices for aligning security and risk using RBA. Bring your Risk Register to the session!