Hello,
I'm implementing Splunk Security Essentials in an environment that already has detection rules, based on the Mitre Att&CK framework.
I have correctly entered the datasources in Data Inventory and indicated them as "Availables".
In Content > Custom Content, I added our detection rules by hand. I've specified the Tactics, and the Mitre Techniques and SubTechniques. I've also indicated their status in bookmarking, and some are "Successfully implemented".
When I go to Analytics Advisor > Mitre ATT&CK Framework, I see the "Content (Available)" in the MITRE ATT&CK matrix, and it's consistent with our detection rules.
But when I select Threat Groups, in "2.Selected Content", in "Total Content Selected", I get zero, whereas detection rules relate to the sub-techniques used by the selected Thread Groups.
How can I solve this problem?
