These MITRE ATT&CK® Technique IDs were detailed by FireEye in December 2020. This screenshot shows some of the MITRE ATT&CK® Technique IDs used in the Sunburst attack and detections that can help protect against these techniques. Use the Data Availability filter to filter the detections based on if you have the data available for them. If a detection is enabled, you already have some protection against the listed techniques. Use the Content Enabled filter to filter the detections based on what detections are already running in your environment.

(Optional) Click Edit to enable the Content Enabled filter and the Data Availability filter.Review the detections that appear to determine if your environment is protected against the potential attack.Alternatively, you can add and use the ATT&CK Technique filter to select the MITRE ATT&CK® technique IDs you want to find detections for. Copy and paste or enter the list of MITRE ATT&CK® techniques from the attack report into the search bar.From the main menu in SSE, navigate to the Security Content page.You can search for these MITRE ATT&CK® techniques in SSE to quickly see if your environment has detections to help protect against them: Review MITRE ATT&CK Techniques and Find Detections with Splunk Security EssentialsĪs you review common cybersecurity attacks and threats, you might notice that most reports list the MITRE ATT&CK® techniques used in the attack. With Splunk Security Essentials, your team can now get started quickly with Splunk for Security and begin detecting and responding to threats faster. Enable your security team to identify and address gaps in your security coverage with framework modeling, improving your security posture and demonstrating high-level compliance to your stakeholders. You can take your data and detections a step further with SSE by operationalizing MITRE ATT&CK® and Cyber Kill Chain® frameworks. You and your analysts can explore security use cases and address threats and challenges unique to your business while staying ahead of new and emerging threats with automatic content updates from the Splunk Threat Research Team. Analytic Stories are groups of detections specifically built to detect, investigate, and respond to a specific threat, like Ransomware. With Splunk Security Essentials, also popularly known as SSE, you can get more from your Splunk security offerings with easy-to-deploy detections and Analytic Stories that align to your security journey. We know that your environment can be complex, but Splunk for Security doesn’t have to be. Bolster Your Security Operations with Splunk Security Essentials No matter how you choose to deploy Splunk, you can apply prescriptive guidance and deploy pre-built detections from Splunk Security Essentials to Splunk Enterprise, Splunk Cloud Platform, Splunk SIEM and Splunk SOAR solutions. Continuing to ride the waves of Summer of Security and the launch of Splunk Security Cloud, Splunk Security Essentials is now part of the Splunk security portfolio and fully supported with an active Splunk Cloud or Splunk Enterprise license.

Splunk security essentials