Alright, who's been down the rabbit hole with me? Trying to get a proper correlation search built in ES feels like you need a map written in a dead language. The official docs give you the *theory* of a watchlist, but where's the `splunk_search` that actually works with the `Risk` framework out of the box?
I spent half a day just trying to replicate the "Multiple Failed Logins" example. Their snippet looks clean until you realize it's missing the critical `| from datamodel:` context. It's like they assume you've already memorized the data model schema.
Here's what I mean. The docs might show:
```sql
| tstats summariesonly=false count from datamodel=Authentication.Authentication by _time, user, src
| `drop_dm_object_name("Authentication")`
| search count > 3
```
But they don't tell you:
* If you need the Common Information Model app installed (you do).
* That your source types MUST be mapped correctly, or this returns nothing.
* How to actually tie this to a risk event. The `risk` command examples are buried in a completely different section.
I ended up benchmarking my own lab setup. The performance hit from poorly written correlation searches is real. One I wrote following the "guide" brought my search head's response time from 200ms to over 2 seconds. Had to rewrite it with proper tstats filters.
**My main gripes:**
* **No "real" environment examples.** Give me a GitHub repo with a full use case: data source -> CIM mapping -> correlation search -> action -> notable.
* **The "Risk" framework docs are fragmented.** Is it an adaptive response? A risk object? The terminology is all over the place.
* **Where are the performance considerations?** For a tool that ingests terabytes, they're awfully quiet about how your ES configs can murder your cluster.
Anyone have a go-to external resource? A blog that actually shows the full pipeline? Or are we all just stitching this together with trial, error, and too much coffee?
benchmarks or bust
The docs are bad, but the bigger issue is the cost of running those poorly written searches in production. I've seen teams blow their cloud bill running `tstats` over unmapped data, getting zero results while burning compute cycles.
You mention benchmarking. Did you check the SPL for full table scans? The search head load from those default examples can be brutal. Post your actual `search.conf` or a screenshot of the job inspector timings - otherwise it's just a theory.
And tying it to risk? That's where the real licensing cost hits. Every risk event is another ingest volume spike they'll bill you for.
show me the bill
You're spot on about the cost. I've seen the same thing happen when someone copy-pastes a `tstats` search from the docs without verifying their datamodel acceleration. It burns through credits like nothing.
Your point on risk-based licensing is huge, and honestly a bit scary. It creates this perverse incentive where making your security detections *work better* (generating more risk events) directly increases your bill. Have you looked into whether adjusting the risk attribution rules can throttle that spike, or is it just a fundamental cost of using the framework?
Oh, it's absolutely a fundamental cost. They designed it that way on purpose.
You can tweak risk attribution thresholds, but that's just moving the deck chairs around on a billing model built to scale with your 'success'. The moment you have a real incident and your risk framework lights up, your next invoice has a matching spike. It's not a bug, it's the business model.
Seen it happen after a pentest. More findings, more risk events, 30% higher bill the next month. Coincidence? I don't think so.
cost_observer_42