Splunk Enterprise Security

Need help please. Threat list for MITRE ATT&CK from the following link not working. Thanks a million

SamHTexas
Builder

The error says "Threat list download from

 https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

Can not be downloaded. I have contacted the vendor of the App. few times, No go! Please advise.

 

Labels (1)
0 Karma

XOJ
Path Finder

In case someone else looks at this, if you manually want to place the file:

If you are manually going to download the update, you will grab the raw JSON from https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json Move this to the ES Search Head and place it in $SPLUNK_HOME/var/lib/splunk/modinputs/threatlist/ You will need to save this as mitre_attack for the file name. The mitre_attack file will contain this raw JSON that you downloaded. You should then just be able to run the Threat - Mitre Attack - Lookup Gen saved search and the output in the KV store will be properly populated.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The link works.  Have you checked Splunk's logs?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SamHTexas
Builder

Thank u for your message. The only related info I have seen in the log is "Splunk Enterprise Security suite is not available" which does not make sense. The App is installed on Enterprise Security (ES). Am looking to see if our company has blocked the threat list download link that you tested. I tested it at my company & the link is good. Please advise.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...