Risk Analysis Dashboard - Risk Modifiers by Annotations

[mjuestel2]

Hello:

I recently started playing with the Risk framework, RBA etc. Most of my Risk Analysis dashboard is working within Enterprise Security - except for three (3) sections:

• Risk Modifiers By Annotations
• Risk Score By Annotations
• Risk Modifiers By Threat Object

For the annotations part - we do manually tag Mitre Attack tactics within our content, so not sure why these panels do not show anything.

Also, does anyone know what savedsearches run in the background to populate these panels? I'd like to double check to make sure I have these enabled.

Thanks!

[meetmshah]

Hello @mjuestel2,

The annotations Dashboard would be based on the MITRE Technique value we provide in the correlation searches. Also, it's not savedsearches based on which panels work upon - it's the Risk Data Model - 

Please let me know if you have any questions about the same. Also, please accept the solution and hit Karma, if this helps!