Hi All, Does Splunk Security Essentials app also map our custom (user defined) correlation searches to different MITRE tactics & techniques ?
Based on what i see, if we run the setup wizard it will do so for the pre defined ones that come with ES or with Security Essentials app itself. There is nothing mentioned about custom correlation searches that one sets up in ES.
SSE will do this automatically for you and have your custom detections displayed on the MITRE Overview dashboard. You need to run the Content Introspection setup step and all your detections will appear in SSE just as any other content in there.
It's detailed in the documentation for SSE here