add risk index macro

detections/cloud/correlation_by_repository_and_risk.yml

@@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk
 type: Correlation
 datamodel: []
 description: This search correlations detections by repository and risk_score
-search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source)
+search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source)
   as signals values(user) as user by repository | sort - risk_score | where risk_score
   > 80 | `correlation_by_repository_and_risk_filter`'
 how_to_implement: For Dev Sec Ops POC

detections/cloud/correlation_by_user_and_risk.yml

@@ -6,7 +6,7 @@ author: Patrick Bareiss, Splunk
 type: Correlation
 datamodel: []
 description: This search correlations detections by user and risk_score
-search: '`signals` | fillnull | stats sum(risk_score) as risk_score values(source)
+search: '`risk_index` | fillnull | stats sum(risk_score) as risk_score values(source)
   as signals values(repository) as repository by user | sort - risk_score | where
   risk_score > 80 | `correlation_by_user_and_risk_filter`'
 how_to_implement: For Dev Sec Ops POC

macros/risk_index.yml

@@ -1,4 +1,4 @@
-definition: index=signals
+definition: index=risk
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
-name: signals
+name: risk_index