Risk Analysis Dashboard - Risk Modifiers by Annotations

mjuestel2 — Thu, 12 Oct 2023 19:40:37 GMT

Hello:

I recently started playing with the Risk framework, RBA etc. Most of my Risk Analysis dashboard is working within Enterprise Security - except for three (3) sections:

Risk Modifiers By Annotations
Risk Score By Annotations
Risk Modifiers By Threat Object

For the annotations part - we do manually tag Mitre Attack tactics within our content, so not sure why these panels do not show anything.

Also, does anyone know what savedsearches run in the background to populate these panels? I'd like to double check to make sure I have these enabled.

Thanks!

Re: Risk Analysis Dashboard - Risk Modifiers by Annotations

meetmshah — Fri, 13 Oct 2023 06:15:20 GMT

Hello @mjuestel2,

The annotations Dashboard would be based on the MITRE Technique value we provide in the correlation searches. Also, it's not savedsearches based on which panels work upon - it's the Risk Data Model -

Please let me know if you have any questions about the same. Also, please accept the solution and hit Karma, if this helps!

topic Re: Risk Analysis Dashboard - Risk Modifiers by Annotations in Splunk Enterprise Security

Risk Analysis Dashboard - Risk Modifiers by Annotations

Re: Risk Analysis Dashboard - Risk Modifiers by Annotations