Hey @dhruv_gupta - that certainly checks all pre-req boxes...

On the Target SIR records being created here -- do any of them have data in any of the MITRE fields at all (i.e. is it partially working - or just not working at all) - see screenshot below.

Can we confirm the MITRE (Attack Patterns) table has data on it -> `sn_ti_stix2_attack_pattern`?

------------------------------------------------------------------------------------ 

I think the next best step here would be a NOW Support Case to get eyes on this - especially if we are mostly aligned to baseline configs and no customizations to any of the baseline Script Includes involved.