What does the risk framework add to an object (user, server or other type) to...

The risk framework in Splunk Enterprise Security adds a numeric score to an object (user, server or other type) to indicate increased risk. The numeric score is calculated by summing up the risk scores of all the risk modifiers that are associated with the object. A risk modifier is an event that modifies the risk of an object, such as a malware infection, a failed login, or a suspicious activity. The risk score of a risk modifier is determined by the correlation search that triggers the risk analysis response action, which can be customized or created by the user12. The numeric score of an object reflects its overall risk level and can be used to prioritize investigation and response actions3. References = 1: Risk Analysis framework in Splunk ES - Splunk Documentation - Terminology for the Risk Analysis framework. 2: Risk Analysis framework in Splunk ES - Splunk Documentation - Write a correlation search. 3: About risk-based alerting in Splunk Enterprise Security - Splunk Documentation.