All Apps and Add-ons

Splunk Security Essentials : How to set content/use-case as active

xzinou2
Engager

Hello,

I've been trying this app Splunk Security Essentials on a test instance of Splunk and I have difficulty setting content/use-case as "active".

My main goal is to have a representation of all my existing production alerts on Mitre Att&ck matrice.

I created use-cases in "Custom Content" and enabled exiting ones. On the "Manage Bookmarks" page I have few use-cases, all "Successfully Implemented", but when on the Mitre Overview page none is active, all content have "needs data" status :

example.png

 

I'm sorry if I'm missing something obvious and thank you in advance for your support.

Kind regards.

Labels (2)
0 Karma
1 Solution

jbjerke_splunk
Splunk Employee
Splunk Employee
Spoiler
 

Hi

 

In order for it to be marked as active in the Analytics Advisor you also need to mark the data source as available. You can either do this manually under Data Inventory and the datasource required for you search, or the automatic way, also under Data Inventory. by click the green button in the top right. 

Let me know how you get along. 

Johan

 

View solution in original post

0 Karma

xzinou2
Engager

Hello,

Does anybody has any idea about this please ?

Thank you.

0 Karma

jbjerke_splunk
Splunk Employee
Splunk Employee
Spoiler
 

Hi

 

In order for it to be marked as active in the Analytics Advisor you also need to mark the data source as available. You can either do this manually under Data Inventory and the datasource required for you search, or the automatic way, also under Data Inventory. by click the green button in the top right. 

Let me know how you get along. 

Johan

 

View solution in original post

0 Karma

Ksr1982
Explorer

Hi,

I have difficulty setting content/use-case as "active". I did update the Data Inventory and the data source required for you search.
Can you support me if I am missing anything

Best Regards.

0 Karma

xzinou2
Engager

Hello Johan,

Thank you for your reply.

It did work finally on the production instance. It seems that even with the data source set as available under Data Inventory, the associated SPL search should return results otherwise the status will remains as "Needs data".

I'm marking your reply as a solution.

Thanks again.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!