I am in the process of mapping our use-cases that we have within Splunk / Enterprise Security to Mitre, and am also trying to organize them a bit.
I'm using Splunk Security Essentials 3.6 and have a question concerning Any Splunk Logs.
On the Content Introspection screen - some of my use-cases are organized into different categories such as AWS, Application Load Balance, Authentication, Anti-virus etc.
However, a large percentage of my content just appears under the Any Splunk Logs heading - how can I change this??
I even went back to the Data Inventory screen... and manually defined some of the indexes and sourcetypes to other categories, but nothing has changed.
Help!!
