From e688ffeaf178934064b900e99c25d47753e43bb0 Mon Sep 17 00:00:00 2001 From: bank3rz Date: Wed, 22 Apr 2026 19:13:25 -0700 Subject: [PATCH] Update README.md --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index 841898f..550d78a 100644 --- a/README.md +++ b/README.md @@ -120,3 +120,6 @@ Risk-based alerting in ES can be achieved through `risk_score`, `impact`, and `c An `observables` object is used by Splunk to apply risk to specific objects by way of a `risk` alert action and if an observables object is present, SplunkGen will add RBA fields to the final representation Notables are used in ES as an alert action, and unless suppressed with `notable: false` SplunkGen will generate notable action fields for alerts, with severity the same as the RBA risk score + + +Test