How to Map Custom searches to MITRE framework via Security Essentials app?

[neerajs_81]

Hi All,   Does Splunk Security Essentials app also map our custom (user defined) correlation searches to different MITRE tactics & techniques ? 

Based on what i see,  if we run the setup wizard it will do so for the pre defined ones that come with ES or with Security Essentials app itself.   There is nothing mentioned about custom correlation searches that one sets up in ES.

[jbjerke_splunk]

SSE will do this automatically for you and have your custom detections displayed on the MITRE Overview dashboard. You need to run the Content Introspection setup step and all your detections will appear in SSE just as any other content in there. 

It's detailed in the documentation for SSE here

https://docs.splunk.com/Documentation/SSE/3.6.0/User/ContentIntrospection

j

[neerajs_81]

Yes apparently the new release of  SSE does this. We found out. Thank you for responding. Awarded karma points.

[gcusello · Accepted solution]

Hi @neerajs_81,

if you want this, you should try the MITRE ATTACK App for Splunk (https://splunkbase.splunk.com/app/4617/).

Obviously Security Essentials maps only the correlation searches it knows, and not the custom ones you created in ES.

Ciao.

Giuseppe

[neerajs_81]

Thanks. I thought so but just wanted to confirm. So there is no way literally to make it import custom correlation searches from ES?

[gcusello]

Hi @neerajs_81,

you can manually do it but put attention that ES correlation searches usually use DataModels.

To map MITRE ATTACK searches, use the above App.

Ciao.

Giuseppe