All Apps and Add-ons

ES Content Updates

Nurcan
New Member

How can we see the rules we developed in the ES Content Updates area? How can we define it on the product so that it can be seen on this screen by categorizing according to Cyber Kill Chain and MITER ATTACK Framework?

Nurcan_0-1626334238877.png

 

Labels (1)
0 Karma

efika
Communicator

Hi @Nurcan 

 

You will have wrap the rules you have developed inside an Analytic Story for it to be displayed in ESCU.

Go to Configure->Content Management-> Create New Content and choose Analytic Story.

The mapping to Cyber Kill Chain and MITER ATTACK Framework will be derived by the annotations you created for the Correlation Search.

 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...