Splunk Enterprise Security

How to collect correlation searches that are enabled and aligned to mitre att&ck framework?

JLopez
Explorer

Hi Splunkers,

I need to show to some stakeholders the correlation searches that we have enabled and are aligned to the mitre att&ck framework.

I've tried using the REST command and I can find all the annotations under "action.correlationsearch.annotations" field  but I would like to narrow it down to only mitre att&ck.

Anyone knows how to get this search? 

Tags (1)
0 Karma

meetmshah
Builder

Hello @JLopez, Can you check if this is something you want - 

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches 
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") 
| where disabled=0 
| eval actions=split(actions, ",") 
| rename title as "Correlation Search", cron_schedule as "Cron Schedule" "dispatch.earliest_time" as "Earliest Time" dispatch.latest_time as "Latest Time" actions as "Actions" action.correlationsearch.annotations as "Annotations"
| eval flag=if(LIKE(Annotations,"%mitre_attack%"),1,0)
| table "Correlation Search" "Cron Schedule" "Earliest Time" "Latest Time" "Actions" Annotations flag
0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...