The configuration shown contains two separate Risk Modifiers , so a single detection result will generate two risk events .
The first Risk Modifier assigns:
Risk Score: 10
Risk Object Field: src
Risk Object Type: system
The second Risk Modifier assigns:
Risk Score: 10
Risk Object Field: user
Risk Object Type: user
Splunk Enterprise Security creates a separate risk event for each configured risk modifier because each modifier applies risk to a distinct risk object . In this example, one event attributes risk to the source system represented by src, while another attributes risk to the account represented by user.
The two scores are not added together to determine the number of events . Therefore, option A (20) confuses total numerical risk contribution with event count, while option C (10) represents the score assigned to each individual risk event rather than the number created. Option B is incorrect because there are two configured risk objects.
This configuration is a common Risk-Based Alerting pattern: one suspicious action can simultaneously contribute risk to multiple entities involved in the activity.
Study Guide topics: Risk Analysis Adaptive Response Action, Risk Modifiers, risk objects, risk object types, risk scores, Risk-Based Alerting.
