Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add configurable notable severity #51

Closed
wants to merge 2 commits into from

Conversation

linuxdaemon
Copy link
Contributor

This allows you to set the severity of a detection in its config

This allows you to set the severity of a detection in its config
@josehelps josehelps added the enhancement New feature or request label Jun 24, 2024
@pyth0n1c
Copy link
Contributor

pyth0n1c commented Jul 3, 2024

Hi folks! I know this PR has been outstanding for a long time, but were are looking to implement it.
In this PR, the severity is set manually. Do you prefer this, or would you prefer it to be set dyanimically based on the risk score? For example, based on the risk score:
0-19: INFORMATIONAL
20-39: LOW
40-59: MEDIUM
60-79: HIGH
CRITICAL:80-100

This means one less field a user will have to set.
Any thoughts?
You can see a relevant link to Enterprise Security Docs here: https://docs.splunk.com/Documentation/ES/7.3.2/User/RiskScoring#:~:text=Risk%20score%20levels%20use%20the%20same%20naming%20convention%20as%20event%20severity.%20You%20can%20assess%20relative%20risk%20scores%20by%20comparing%20hosts%20with%20similar%20roles%20and%20asset%20priority.

@linuxdaemon
Copy link
Contributor Author

Hey @pyth0n1c, I'm no longer with Etsy so will not be continuing work on these PRs.

@pyth0n1c
Copy link
Contributor

This PR will be closed as the changes are now tracked in the following PR:
#191

Risk Severity will be set automatically based on the risk_score, which is a combination of the impact and confidence fields.

@pyth0n1c pyth0n1c closed this Jul 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request external
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants