About Mandy8

Mandy8 · 02-11-2021

Does anyone have any documentation on how to configure the Splunk "ServiceNow Event Integration" to include MITRE-ATT&CK TTPs to use in the new Threat Intelligence MITRE ATT&CK framework? I found documentation on how to "Auto-extract technique rules ...

Mandy8 · 02-18-2021

I found out yesterday that we aren't running ES (we have a Splunk instance named ES, however, Enterprise Security is not installed), so I was thinking I would add the TTP to the "ServiceNow Event Integration" description field. I would have to config...

Mandy8 · 02-17-2021

Thank you! Do I have to use correlation rules or can I use normal Splunk searches run on a schedule? If I can use normal scheduled Splunk searches, is there a way to hardcode the TTP into the ServiceNow Event Integration event that gets sent to SIR?

Mandy8 · 02-12-2021

Apparently, my organization is not going to start the process of installing the Splunk Security Essentials until Q4. We have scheduled Splunk alerts that send events to the Security Incident Response app. Is there a way to hard code the TTP's in the ...

Mandy8 · 02-12-2021

Thank you SO much, this clarifies a lot!

Mandy8 · 02-11-2021

We are using Splunk Enterprise Security. Based on the recommendations you made, I need to use the Splunk ES Correlation Rules then figure out how to get that data into the "ServiceNow Event Integration" configurations, correct? Do you know of any do...

User Activity

Configure Splunk events to include MITRE ATT&CK TTPs

Re: Configure Splunk events to include MITRE ATT&CK TTPs

Re: Configure Splunk events to include MITRE ATT&CK TTPs

Re: Configure Splunk events to include MITRE ATT&CK TTPs

Re: Configure Splunk events to include MITRE ATT&CK TTPs

Re: Configure Splunk events to include MITRE ATT&CK TTPs