topic Re: Enerprise Security posture is empty in Splunk Enterprise Security

Enerprise Security posture is empty

m1ster1985 — Mon, 20 Sep 2021 08:34:51 GMT

I have installed Enterprise Security App.

I review Security Domain, in particular, Access and Network sections and I see many events coming from my AD, Office 365, and Firewalls.

However, Security Posture dashboards are all empty.

I have checked permissions and given full access.

Could you advise what I should check to fix it?

Re: Enerprise Security posture is empty

Azeemering — Mon, 20 Sep 2021 10:06:09 GMT

Did you really check though? The Security Posture dashboard is 100% driven by notables.

Did you check if there are any notables generated?

If you go the the Incident Review dashboard. Do you have any notables there?

Do you get any results when you run the underlying spl queries? ;

| `es_notable_events`

or without macro and even more simple:

| inputlookup es_notable_events

Re: Enerprise Security posture is empty

m1ster1985 — Mon, 20 Sep 2021 10:42:08 GMT

Thank you for the reply.

The Incident Review dashboard is also empty.

I have executed a request and nothing empty result.

But when I review events using Security Domains, I see a lot of events.

For instance, Access Centre.

Very strange, I have no idea why this is happening in this way.

Re: Enerprise Security posture is empty

Azeemering — Mon, 20 Sep 2021 10:50:02 GMT

Why would it be strange? No notables means no data in the Security Posture dashboard....

Next step for you would be to figure out why you do not have any notables.
Create some test notables.

You can create them this way:

makeresults | eval dest="splunkftw" | sendalert notable

I'm more worried about the lack of ES knowledge and the task that you got to install and configure ES...

Check this:

https://dev.splunk.com/enterprise/docs/devtools/enterprisesecurity/notableeventsplunkes/

Re: Enterprise Security posture is empty

ro_mc — Mon, 20 Sep 2021 13:38:55 GMT

You can also check index=notable.

Notable events are typically generated as an Adaptive Response Action for a correlation search.

You can see this from the Enterprise Security menu bar under Configure -> Content -> Content Management. Correlation searches must be enabled and search conditions met before notable events are generated and become visible from the Security Posture and Incident Review dashboards.

You can use existing correlation searches, use the Splunk ES Content Update (ESCU) app from Splunkbase at https://splunkbase.splunk.com/app/3449/, or generate your own searches using the guidance at https://docs.splunk.com/Documentation/ES/6.6.0/Admin/Correlationsearchoverview.

You can also edit the Security Posture dashboard to display other key indicators, but the default ones cover the main security domains and frameworks used by Enterprise Security.

Re: Enterprise Security posture is empty

m1ster1985 — Tue, 21 Sep 2021 07:39:33 GMT

Thank you very much.

I enabled objects in the Content Management and Security Posture instantly filled with different events.

Re: Enerprise Security posture is empty

m1ster1985 — Tue, 21 Sep 2021 07:45:54 GMT

Thank you very much.

You are right, I do not have appropriate knowledge in ES. 😞

Hope, I will fix it in the near future.

After enabling objects in Content Management, I started receiving notable events.