All Apps and Add-ons

How to Map Custom searches to MITRE framework via Security Essentials app?

neerajs_81
Builder

Hi All,   Does Splunk Security Essentials app also map our custom (user defined) correlation searches to different MITRE tactics & techniques ? 

Based on what i see,  if we run the setup wizard it will do so for the pre defined ones that come with ES or with Security Essentials app itself.   There is nothing mentioned about custom correlation searches that one sets up in ES.

Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

if you want this, you should try the MITRE ATTACK App for Splunk (https://splunkbase.splunk.com/app/4617/).

Obviously Security Essentials maps only the correlation searches it knows, and not the custom ones you created in ES.

Ciao.

Giuseppe

View solution in original post

jbjerke_splunk
Splunk Employee
Splunk Employee

SSE will do this automatically for you and have your custom detections displayed on the MITRE Overview dashboard. You need to run the Content Introspection setup step and all your detections will appear in SSE just as any other content in there. 

 

It's detailed in the documentation for SSE here

https://docs.splunk.com/Documentation/SSE/3.6.0/User/ContentIntrospection

 

j

neerajs_81
Builder

Yes apparently the new release of  SSE does this. We found out. Thank you for responding. Awarded karma points.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

if you want this, you should try the MITRE ATTACK App for Splunk (https://splunkbase.splunk.com/app/4617/).

Obviously Security Essentials maps only the correlation searches it knows, and not the custom ones you created in ES.

Ciao.

Giuseppe

neerajs_81
Builder

Thanks. I thought so but just wanted to confirm. So there is no way literally to make it import custom correlation searches from ES?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

you can manually do it but put attention that ES correlation searches usually use DataModels.

To map MITRE ATTACK searches, use the above App.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...