topic Using custom content with MITRE ATT&CK Framework in Splunk Enterprise Security

Using custom content with MITRE ATT&CK Framework

chooglin — Sun, 07 Jun 2020 15:33:08 GMT

I have custom content that I've created in SSE and mapped to various parts of the MITRE Framework. The problem is SSE only seems to be picking up Splunk ES and ESCU content, not the custom stuff I've done. Is there a solution for this?

Re: Using custom content with MITRE ATT&CK Framework

lkutch_splunk — Wed, 30 Sep 2020 16:27:22 GMT

Which version of ES are you using? And are you mapping them in correlation searches or trying to map in a different way?
https://docs.splunk.com/Documentation/ES/6.3.0/Admin/Configurecorrelationsearches#Use_security_framework_annotations_in_correlation_searches