Risk-Based Alerting: Accumulating Weak Signals into One Notable
Why RBA exists
Threshold alerting fails against quiet adversaries: each individual detection sits below the threshold, yet the combination is damning. Risk-Based Alerting turns each detection into a risk score attached to a risk object (a system, a user, or "other"), lets scores accumulate, and raises a single notable only when the total crosses the configured threshold. Alert volume drops and context rises.
Mechanics
A risk rule is a search with a risk adaptive-response action; it writes risk events into the risk index. Each event's score is the risk modifier (severity or priority) scaled by the risk object's weight, which comes from asset or identity priority and criticality. Scores are summed per risk object over the risk window (30 days by default); when the sum exceeds the threshold (100 by default), ES creates a risk notable listing every contributing detection.
Traps
Risk events are not notables - they appear in Risk Analysis, not Incident Review - until the threshold is crossed. Scores age out with the window, so shortening the window or lowering the threshold changes results immediately. Raising a risk rule's weight scales its contribution linearly and can cause a flood. Threat intelligence matches also attach risk to the objects involved.
Worked example: three low-fidelity detections score 30, 40, and 50 on user jdoe inside the window. The sum is 120, above the default 100, so one notable presents all three detections as a single story instead of three disconnected alerts.