Splunk Security Essentials : How to set content/use-case as active

[xzinou2]

Hello,

I've been trying this app Splunk Security Essentials on a test instance of Splunk and I have difficulty setting content/use-case as "active".

My main goal is to have a representation of all my existing production alerts on Mitre Att&ck matrice.

I created use-cases in "Custom Content" and enabled exiting ones. On the "Manage Bookmarks" page I have few use-cases, all "Successfully Implemented", but when on the Mitre Overview page none is active, all content have "needs data" status :

I'm sorry if I'm missing something obvious and thank you in advance for your support.

Kind regards.

[xzinou2]

Hello,

Does anybody has any idea about this please ?

Thank you.

[jbjerke_splunk · Accepted solution]

Spoiler

Hi

In order for it to be marked as active in the Analytics Advisor you also need to mark the data source as available. You can either do this manually under Data Inventory and the datasource required for you search, or the automatic way, also under Data Inventory. by click the green button in the top right. 

Let me know how you get along. 

Johan

[Ksr1982]

Hi,

I have difficulty setting content/use-case as "active". I did update the Data Inventory and the data source required for you search.
Can you support me if I am missing anything

Best Regards.

[xzinou2]

Hello Johan,

Thank you for your reply.

It did work finally on the production instance. It seems that even with the data source set as available under Data Inventory, the associated SPL search should return results otherwise the status will remains as "Needs data".

I'm marking your reply as a solution.

Thanks again.