Splunk Search

Splunk Security Essential - MITRE ATT&CK Matrix

lorispiana
New Member

HI all,

I just installed the security essential app on my splunk but i'm having issues retrieving the MITRE matrix.

I get the following error: External search command 'mitremap' returned error code 1. Script output = "Error! "{""status"": ""ERROR"", ""description"": ""Error occurred reading enterprise-attack.json"", ""message"": ""'objects'""}" "

This error occurs both in the default dashboard for MITRE Framework but also if i try to use the command | mitremap  in the search.

Does anyone have any suggestion to solve this?

Thank you in advance!

Labels (1)
0 Karma

Tiny_Trex
Engager

I have the same issue. We use Splunk Cloud, and the permissions are fine. I did not uninstall and reinstall, as I'm not sure of the full ramifications of that.

I don't know if it's related or not, but I noticed it after I installed the latest version from Splunkbase. 

0 Karma

Tiny_Trex
Engager

I created a support ticket, and they confirmed that this is a bug that will be fixed in the next release of SSE. However, they could not provide a date for the update and recommended that I downgrade back to 3.7.1. I did so and that worked. I've asked that they update the "Known Issues" list with this bug info.

0 Karma

sohailmohammed
Explorer

@lorispiana Did you resolve this issue ? I am facing the same problem, can you please let me know. Thank you

Tags (1)
0 Karma

deepakc
Builder

From the error "Error occurred reading enterprise-attack.json"

Could it be that it can’t find the file or it's a permissions issue?

A few things to check:

  1. Verify Permissions (User/Role) access to the security essentials app.
  2. Verify if it was installed correctly with correct permissions (via Gui or copy to /opt/splunk/etc/apps/ folder with correct splunk OS level permissions, assumiing this was linux based)
  3. Uninstall and re-install.

 

See how that goes first.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...