mitre visualisation for notable

[user487596]

Hello everyone, I'm new to Splunk, can anyone help me: enable "Using visualizations to determine TTP coverage" from https://lantern.splunk.com/?title=Security%2FUCE%2FGuided_Insights%2FCyber_frameworks%2FAssessing_an... ?

https://docs.splunk.com/Documentation/ES/7.1.0/RBA/ViewMitreMatrixforRiskNotable#View_the_MITRE_ATT....

Splunk Enterprise Security Splunk Security Essentials 

[user487596]

The answer in this splunk blog post.

Somewhere in "System Configuration" we can configure integration with ES. Nuance - I opened this settings menu once, but the second time I can’t find it 😄

[gcusello]

Hi @user487596 ,

to help you, I need some additional information:

what's your issue?

did you installed the Splunk MITRE ATT&CK app (https://splunkbase.splunk.com/app/4617 )?

are you working inside Enterprise Security or not?

Ciao.

Giuseppe

[user487596]

Hi @gcusello ,

don't see "MITRE ATTACK App for Splunk" in apps; yes, i'am work inside Enterprise Security

[gcusello]

Hi @user487596 ,

install it from Splunkbase I always use it: you'll find inside it useful Use Cases for ES.

Ciao.

Giuseppe

[user487596]

@gcusello, what about MITRE ATT&CK Framework in Splunk Security Essentials, which, as I understand it, is already built in, Is it impossible to work with it or is it easier with your application?

[gcusello]

Hi @user487596 ,

yes, in Security Essentials App you have also a MITRE visualization, but I'm hinting to use the above MITRE ATT&CK app.

Ciao.

Giuseppe

[user487596]

@gcusello , The application is cool, but I would like to understand the built-in capabilities. Is there any documentation or tips on how to set up visualization without third-party applications?

[gcusello]

Hi  @user487596 ,

as I said, I always use the MITRE ATT&CK app, but if you want to use only the Security Essentials, see this:

https://docs.splunk.com/Documentation/SSE/3.8.0/User/MITREFramework

Ciao.

Giuseppe

[user487596]

doesn't look like what i need, it's just a dashboard 
i need this https://docs.splunk.com/Documentation/ES/7.1.0/RBA/ViewMitreMatrixforRiskNotable#View_the_MITRE_ATT.... the problem is that the event doesn't have this (MITRE ATT&CK Posture for this Notable) information in notable... how to add it?