RBA pitfalls

[ZachTheSplunker]

Question from "The Office" Hours meetup

What are some common pitfalls when implementing RBA?

[ZachTheSplunker]

Answer from "The Office" Hours meetup

• Trying to boil the ocean. You need to start small, and gradually evolve. Risk generation without curation means just as many notables as traditional alerting, or even more.
• Availability of some sort of A&I framework is important, though not a deal breaker. Let's just say it will make your life much easier. - - At least have a list of your most important users and systems to start with.
• People aspects: internal disconnect between management and the frontliners.
• Not having a technical or business champion and not involving necessary teams before implementing.

Helpful:

• App that populates your A&I from Crowdstrike: https://splunk-sa-crowdstrike.ztsplunker.com/