topic Re: mitre visualisation for notable in Dashboards & Visualizations

mitre visualisation for notable

user487596 — Tue, 11 Jun 2024 16:52:38 GMT

Hello everyone, I'm new to Splunk, can anyone help me: enable "Using visualizations to determine TTP coverage" from https://lantern.splunk.com/?title=Security%2FUCE%2FGuided_Insights%2FCyber_frameworks%2FAssessing_and_expanding_MITRE_ATT%26CK_coverage_in_Splunk_Enterprise_Security# ?

https://docs.splunk.com/Documentation/ES/7.1.0/RBA/ViewMitreMatrixforRiskNotable#View_the_MITRE_ATT....

Re: mitre visualisation for notable

gcusello — Tue, 11 Jun 2024 13:24:29 GMT

Hi @user487596 ,

to help you, I need some additional information:

what's your issue?

did you installed the Splunk MITRE ATT&CK app (https://splunkbase.splunk.com/app/4617 )?

are you working inside Enterprise Security or not?

Ciao.

Giuseppe

Re: mitre visualisation for notable

user487596 — Tue, 11 Jun 2024 13:29:26 GMT

Hi @gcusello ,

don't see "MITRE ATTACK App for Splunk" in apps; yes, i'am work inside Enterprise Security

Re: mitre visualisation for notable

gcusello — Tue, 11 Jun 2024 13:32:15 GMT

Hi @user487596 ,

install it from Splunkbase I always use it: you'll find inside it useful Use Cases for ES.

Ciao.

Giuseppe

Re: mitre visualisation for notable

user487596 — Tue, 11 Jun 2024 13:36:17 GMT

@gcusello, what about MITRE ATT&CK Framework in Splunk Security Essentials, which, as I understand it, is already built in, Is it impossible to work with it or is it easier with your application?

Re: mitre visualisation for notable

gcusello — Tue, 11 Jun 2024 13:39:33 GMT

Hi @user487596 ,

yes, in Security Essentials App you have also a MITRE visualization, but I'm hinting to use the above MITRE ATT&CK app.

Ciao.

Giuseppe

Re: mitre visualisation for notable

user487596 — Tue, 11 Jun 2024 13:41:47 GMT

@gcusello , The application is cool, but I would like to understand the built-in capabilities. Is there any documentation or tips on how to set up visualization without third-party applications?

Re: mitre visualisation for notable

gcusello — Tue, 11 Jun 2024 13:55:05 GMT

Hi @user487596 ,

as I said, I always use the MITRE ATT&CK app, but if you want to use only the Security Essentials, see this:

https://docs.splunk.com/Documentation/SSE/3.8.0/User/MITREFramework

Ciao.

Giuseppe

Re: mitre visualisation for notable

user487596 — Tue, 11 Jun 2024 14:44:05 GMT

doesn't look like what i need, it's just a dashboard
i need this https://docs.splunk.com/Documentation/ES/7.1.0/RBA/ViewMitreMatrixforRiskNotable#View_the_MITRE_ATT.26CK_posture_for_a_risk_notable the problem is that the event doesn't have this (MITRE ATT&CK Posture for this Notable) information in notable... how to add it?

Re: mitre visualisation for notable

user487596 — Tue, 18 Jun 2024 08:32:01 GMT

The answer in this splunk blog post.

Somewhere in "System Configuration" we can configure integration with ES. Nuance - I opened this settings menu once, but the second time I can’t find it 😄