Splunk Security Essential - MITRE ATT&CK Matrix

[lorispiana]

HI all,

I just installed the security essential app on my splunk but i'm having issues retrieving the MITRE matrix.

I get the following error: External search command 'mitremap' returned error code 1. Script output = "Error! "{""status"": ""ERROR"", ""description"": ""Error occurred reading enterprise-attack.json"", ""message"": ""'objects'""}" "

This error occurs both in the default dashboard for MITRE Framework but also if i try to use the command | mitremap  in the search.

Does anyone have any suggestion to solve this?

Thank you in advance!

[deepakc]

From the error "Error occurred reading enterprise-attack.json"

Could it be that it can’t find the file or it's a permissions issue?

A few things to check:

1. Verify Permissions (User/Role) access to the security essentials app.
2. Verify if it was installed correctly with correct permissions (via Gui or copy to /opt/splunk/etc/apps/ folder with correct splunk OS level permissions, assumiing this was linux based)
3. Uninstall and re-install.

See how that goes first.