How to map mitre attack content in Splunk Security Essentials?

Amadou · ‎06-05-2024

How to map mitre attack content in Splunk Security Essentials?

I want to map mitre attack for all of my created alert inside of splunk entreprise

tej57 · ‎06-07-2024

I believe SSE should be used in conjunction with Splunk Enterprise Security. The correlation searches within ES, ESCU, and SSE have MITRE tactics associated with each of them. The number of correlation searches with MITRE tactics are highlighted with dark color on the SSE dashboard and the less number would be light in shade.

I do not think this is possible to achieve on Splunk Enterprise. However, if you are able to achieve this through custom solution using .css or .js, let the community know.

Thanks,
Tejas.

Mitre Attack Mapping on splunk

How to map mitre attack content in Splunk Security Essentials?

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation

Mitre Attack Mapping on splunk

How to map mitre attack content in Splunk Security Essentials?

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling