thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Risk-Based Alerting (RBA)

A detection approach that assigns risk scores to entities for suspicious observations and alerts only when cumulative risk exceeds a threshold.

Definition

Instead of alerting on every low-fidelity event, RBA records risk events with scores and ATT&CK annotations against users and systems, then triggers an alert when the total risk or the variety of techniques crosses a threshold. This dramatically reduces alert volume while surfacing multi-stage attacks. Splunk ES popularized RBA.

Example

A user accumulates risk from an unusual login, a new MFA device and mass file access, triggering one high-confidence alert.

Exam tip

RBA is the answer for reducing alert fatigue while keeping coverage of low-signal behaviors.

Related terms