The correct field is risk_message . In Splunk Enterprise Security Risk-Based Alerting, risk_message provides a human-readable description of the suspicious activity represented by a risk event. It gives analysts contextual information explaining what happened and why the risk contribution was generated.
This should be distinguished from risk_object , which identifies the entity receiving risk—for example, a username, host, system, or other security-relevant object. A typical risk event therefore combines fields conceptually such as:
risk_object= " jsmith "
risk_object_type= " user "
risk_score=40
risk_message= " User executed suspicious PowerShell command "
The risk object answers who or what is accumulating risk , while risk_message explains the activity responsible for that risk . risk_description and risk_reason are distractors and are not the standard field requested.
The uploaded guide strongly covers Risk Framework concepts, including risk objects, risk scores, Risk Factors, and Risk Analysis, although this exact field-name question is not presented verbatim in the supplied 60-question set.
Study Guide topics: Risk Framework, risk index, risk_message, risk objects, Risk-Based Alerting, contextual findings.
