|
1 | | -# Splunk attack range reporting |
| 1 | +# Splunk Attack Range Reporting |
2 | 2 | A Splunk App for Attack Range Reporting. Provides dashboards for insights on your attack range simulations. |
3 | 3 |
|
4 | | - |
5 | | -Splunk attack range repo can be found [here](https://github.com/splunk/attack_range) |
| 4 | +The Splunk Attack Range repo can be found [here](https://github.com/splunk/attack_range) |
6 | 5 |
|
7 | 6 | ## What is it ? |
8 | | -It is a Splunk app that provides dashboards that enable a user of Splunk attack range to have better view of what simulations run, relevant security content from other Splunk apps and overview of the available Atomic Red tests. |
| 7 | +It is a Splunk app that provides dashboards that enable a user of Splunk Attack Range to have better view of what simulations were run, relevant security content from other Splunk apps and overview of the available Atomic Red tests. |
9 | 8 |
|
10 | 9 | ## Compatibility and dependencies |
11 | | -v1.0.0 of the app is compatible with the below |
| 10 | +v1.0.x of the app is compatible with the following: |
12 | 11 |
|
13 | | -+ Splunk 8.0.x |
| 12 | ++ Splunk 8.x.x |
14 | 13 | + [Splunk Analytic Story execution v1.0](https://github.com/splunk/analytic_story_execution) |
15 | 14 | + [Splunk Security Content v1.0.x](https://splunkbase.splunk.com/app/3449/) |
16 | | -+ [Security essentials v3.1.x](https://splunkbase.splunk.com/app/3435/) |
| 15 | ++ [Security Security Essentials v3.1.x](https://splunkbase.splunk.com/app/3435/) |
17 | 16 |
|
18 | 17 | ### Dependencies |
19 | | -v1.0.0 of the app has the following depencencies |
| 18 | +This application has the following depencencies: |
20 | 19 |
|
21 | 20 | + [Punchcard - Custom Visualization](https://splunkbase.splunk.com/app/3129/) |
22 | | -+ [Security essentials v3.1.x](https://splunkbase.splunk.com/app/3435/) |
| 21 | ++ [Splunk Security Essentials v3.x.x](https://splunkbase.splunk.com/app/3435/) |
23 | 22 | + [Status Indicator - Custom Visualization](https://splunkbase.splunk.com/app/3119/) |
| 23 | ++ [Sankey Diagram - Custom Visualization](https://splunkbase.splunk.com/app/3112/) |
24 | 24 |
|
25 | 25 | ## What does it look like ? |
26 | 26 |
|
27 | | -Main dashboard is showing simulations run, users, hosts, MITRE ATT&CK tactics and techniques, tests executed and potential mapping with analytic stories. |
| 27 | +The Main dashboard gives you an overview of the simulations run, users, hosts, MITRE ATT&CK tactics and techniques, tests executed and potential mapping with analytic stories. |
28 | 28 |
|
29 | 29 |  |
30 | 30 |
|
31 | | -The second dashboard (Navigator) shows all the available atomic red tests and their potential mappings to security content. Reason it is "potential" is because the mapping is just been made based on the tactique referenced from the test and the security content. This does not necessarily mean that a specific atomic red test will detonate a detection. And this is where you should read more on what ATT&CK is all about :) |
| 31 | +The second dashboard (Navigator) shows all the available Atomic Red tests and their potential mappings to security content. The reason we categorize those as "potential" is because the mapping is simply made based on the MITRE tactic referenced in the test and the security content. This does not necessarily mean that a specific Atomic Red Test will trigger a particular detection. This is where you should read more on what ATT&CK is all about and how the Splunk [Security Content](https://research.splunk.com) maps to it. :) |
32 | 32 |
|
33 | 33 |
|
34 | 34 |  |
35 | 35 |
|
36 | | - |
37 | 36 | Finally there is a dashboard made with Splunk dashboards - Beta which looks nice but still in beta ! |
38 | 37 |
|
39 | 38 |  |
40 | 39 |
|
41 | 40 | ## Contributors |
42 | | -[Christian Cloutier](https://github.com/ccloutier-splunk) |
| 41 | +[Christian Cloutier](https://github.com/ccloutier-splunk) |
0 commit comments