question Mitre Technique Extraction - Splunk, MISP Nothing working in SecOps forum

Mitre Technique Extraction - Splunk, MISP Nothing working

dhruv_gupta — Wed, 24 Jul 2024 14:26:00 GMT

Hi all,

We are implementing MITRE framework. We tried configuring auto extraction rule but they dont seem to be working. Has anybody implemented that or can share some insights. That will be really helpful

@andy_ojha

Re: Mitre Technique Extraction - Splunk, MISP Nothing working

Martin Dewit — Wed, 24 Jul 2024 14:44:24 GMT

For Splunk, have you looked at this post?

https://www.servicenow.com/community/secops-forum/configure-splunk-events-to-include-mitre-att-ck-ttps/m-p/1285212

For MISP, the docs specify settings within the integration. Have you configured those?

https://docs.servicenow.com/csh?topicname=review-the-misp-integration-settings.html&version=latest

Re: Mitre Technique Extraction - Splunk, MISP Nothing working

dhruv_gupta — Wed, 24 Jul 2024 14:48:00 GMT

yaa all checked.

Re: Mitre Technique Extraction - Splunk, MISP Nothing working

andy_ojha — Wed, 24 Jul 2024 15:02:24 GMT

Hey @dhruv_gupta - looks like @Martin Dewit has got you on the right track.

A few questions that may help:

1) Have we already configured MITRE ATT&CK - and pulled in the data from the "TAXII Profiles"?
- Assuming we went with "Enterprise ATT&CK" but can you confirm?

2) What flavor of Splunk are we using?
- Are we using Splunk Enterprise Security (ES) - where the Notable Events actually have MITRE ATT&CK TTPs in the Notable event field data?

3) How are we integration Splunk with SecOps?
- Are we using the NOW Store App - and setup the Profiles for Automated ingestion (scheduled)?
- Or, are we first testing with the "Manual" option to push Notables to NOW with the button?

4) Can you confirm on the ServiceNow config side -> the Extraction Rule for Splunk -> has the Ignore option disabled (false)?

Re: Mitre Technique Extraction - Splunk, MISP Nothing working

dhruv_gupta — Tue, 30 Jul 2024 09:41:54 GMT

1;)

2:) & 3:)

4:)

Re: Mitre Technique Extraction - Splunk, MISP Nothing working

andy_ojha — Wed, 24 Jul 2024 15:55:20 GMT

Hey @dhruv_gupta - that certainly checks all pre-req boxes...

On the Target SIR records being created here -- do any of them have data in any of the MITRE fields at all (i.e. is it partially working - or just not working at all) - see screenshot below.

Can we confirm the MITRE (Attack Patterns) table has data on it -> `sn_ti_stix2_attack_pattern`?

------------------------------------------------------------------------------------

I think the next best step here would be a NOW Support Case to get eyes on this - especially if we are mostly aligned to baseline configs and no customizations to any of the baseline Script Includes involved.

Re: Mitre Technique Extraction - Splunk, MISP Nothing working

Dhruvii — Wed, 24 Jul 2024 15:53:58 GMT

No data i just created a case