Alpha Level Alert Refinery

This app, when used in conjunction with the Alpha Level Alert Refinery, automatically enriches Splunk Enterprise Security notable events with Alpha Level scores. Alpha Level pulls events over the management port, scores them externally, and pushes results back via HEC. Each alert receives an Alpha Score and Alpha Determination based on how likely it is to be a True Positive (higher score is more likely). Scores are joined to events automatically via a KV store lookup, so analysts see them directly in Incident Review. The app includes a Readiness dashboard to verify your environment is configured correctly before enabling the integration.