What type of value appears in the red box in the following image?
Splunk Enterprise Security displays a colored numeric badge next to asset and identity field values (such as src, dest, src_user, or user) in notable event details to represent that entity's contributing risk score, with badge color intensifying from yellow through orange to dark red as the score increases past defined thresholds (e.g., above 75). This risk score badge is a Risk-Based Alerting feature and is distinct from source rankings, event priority, or IP reputation ratings, which are not represented this way in the notable event field list.
Community Discussion