Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat Topology and MITRE ATT&CK Visualizations

[WhitneySink]

Struggling with alert fatigue, lack of context, and prioritization around security incidents? With Splunk Enterprise Security 7.1, we made it even easier to analyze malicious activities and determine the scope of incidents faster. Splunk Enterprise Security 7.1 new visualization features include Threat Topology, which determines the scope of security incidents, and MITRE ATT&CK Framework Visualization, which highlights the tactics and techniques observed in risk events so that you can respond faster.

Highlights:

• Quickly discover the scope of an incident to respond with accuracy
• Improve security workflow efficiencies with embedded frameworks
• Operationalize the MITRE ATT&CK framework when responding to Notable Events
• Identify additional impacted subjects of an investigation without writing a single line of code of query language

[dokaas_2]

These visualizations looks great.  However, I'm on version 7.1.1 and I don't see the visualizations.  Is there any special configurations/conditions required to get them to display?

[WhitneySink]

@dokaas_2 

Thanks for the question.  The topology and MITRE will show if there is data associated to and the visualization should display on 7.1.1.  You should not need to make any changes to your configurations.  The matrix will show for all notable events that have the following fields:

• risk_object
• risk_object_type
• annotations.mitre_attack.mitre_technique_id

Here is a resource with more information: Assessing and expanding MITRE ATT&CK coverage in Splunk Enterprise Security.