Skip to content

Commit f28d881

Browse files
ccl0utierccl0utier
committed
Add MITRE Content Based Search Dashboard
1 parent 050c213 commit f28d881

File tree

4 files changed

+168
-17
lines changed

4 files changed

+168
-17
lines changed

‎README.md‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,24 @@ This application has the following depencencies:
2121
+ [Splunk Security Essentials v3.x.x](https://splunkbase.splunk.com/app/3435/)
2222
+ [Status Indicator - Custom Visualization](https://splunkbase.splunk.com/app/3119/)
2323
+ [Sankey Diagram - Custom Visualization](https://splunkbase.splunk.com/app/3112/)
24+
+ [Parallel Coordinates - Custom Visualization](https://splunkbase.splunk.com/app/3137)
25+
26+
**Note:** The application will fallback to not showing any panels that rely on prerequisite visualizations if they are missing.
2427

2528
## What does it look like ?
2629

2730
The Main dashboard gives you an overview of the simulations run, users, hosts, MITRE ATT&CK tactics and techniques, tests executed and potential mapping with analytic stories.
2831

2932
![Main Dashboard](appserver/static/docs/img/ar_main_dashboardv1.0.png?raw=true "Main Dashboard")
3033

31-
The second dashboard (Navigator) shows all the available Atomic Red tests and their potential mappings to security content. The reason we categorize those as "potential" is because the mapping is simply made based on the MITRE tactic referenced in the test and the security content. This does not necessarily mean that a specific Atomic Red Test will trigger a particular detection. This is where you should read more on what ATT&CK is all about and how the Splunk [Security Content](https://research.splunk.com) maps to it. :)
32-
34+
The second dashboard (Navigator) shows all the available Atomic Red tests and their potential mappings to security content. The reason we categorize those as "potential" is because the mapping is simply made based on the MITRE technique/subtechnique referenced in the test and the security content. This does not necessarily mean that a specific Atomic Red Test will trigger a particular detection. This is where you should read more on what ATT&CK is all about and how the Splunk [Security Content](https://research.splunk.com) maps to it. :)
3335

3436
![Navigator](appserver/static/docs/img/ar_navigator_dashboardv1.0.png?raw=true "Navigator")
3537

38+
The 3rd dashboard allows you to search for potential Splunk Security Detections, Atomic Red Tests or determine PurpleSharp support for one or more MITRE Att&ck Technique/Subtechnique.
39+
40+
![MITRE Content Based Search](appserver/static/docs/img/ar_mitre_content_search_dashboard.png?raw=true "Content Search")
41+
3642
Finally there is a dashboard made with Splunk dashboards - Beta which looks nice but still in beta !
3743

3844
![Main - Beta](appserver/static/docs/img/ar_dashboards_beta_preview.png?raw=true "Main-Beta")

‎appserver/static/docs/img/ar_mitre_content_search_dashboard.png‎

518 KB
Loading

‎default/data/ui/nav/default.xml‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,11 @@
11
<nav search_view="search">
2-
32
<!-- Set "attack_range_main_dashboard" as the default page -->
43
<collection label="Attack Range Dashboards">
5-
6-
<view name="attack_range_main_dashboard" default="true"/>
7-
<view name="attack_range_navigator" />
8-
9-
10-
4+
<view default="true" name="attack_range_main_dashboard"/>
5+
<view name="attack_range_navigator"/>
6+
<view name="attack_range_mitre_content_search"/>
117
</collection>
12-
13-
<view name="search" />
14-
<view name="datasets" />
15-
<view name="dashboards" />
16-
17-
18-
19-
</nav>
8+
<view name="search"/>
9+
<view name="datasets"/>
10+
<view name="dashboards"/>
11+
</nav>

‎default/data/ui/views/attack_range_mitre_content_search.xml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
<form theme="dark">
2+
<label>MITRE ATT&amp;CK Based Content Search</label>
3+
<description>Displays Splunk Security Detections and Atomic Red/PurpleSharp Tests based on selected MITRE Att&amp;ck technique(s).</description>
4+
<!-- Check if the Parallel Coordinates Visualiztion is installed, and inform the user if not (and adapt the relevant panel content accordingly) -->
5+
<search id="ParallelCoordinatesInstalledSearch">
6+
<query>
7+
| rest /services/apps/local
8+
| where title = "parallel_coordinates_app"
9+
</query>
10+
<finalized>
11+
<condition match=" 'job.resultCount' != 0">
12+
<set token="ParallelCoordinatesInstalled">1</set>
13+
<unset token="ParallelCoordinatesNotInstalled"></unset>
14+
</condition>
15+
<condition>
16+
<unset token="ParallelCoordinatesInstalled"></unset>
17+
<set token="ParallelCoordinatesNotInstalled">1</set>
18+
</condition>
19+
</finalized>
20+
</search>
21+
<fieldset submitButton="false" autoRun="true">
22+
<input type="multiselect" token="tokTechniques" searchWhenChanged="true">
23+
<label>Selected Att&amp;ck Technique(s)</label>
24+
<valuePrefix>mitre_id="</valuePrefix>
25+
<delimiter> OR </delimiter>
26+
<fieldForLabel>label</fieldForLabel>
27+
<fieldForValue>value</fieldForValue>
28+
<search>
29+
<query>| inputlookup enterprise-attack-lookup
30+
| stats count by Technique, mitre_technique_display
31+
| eval value = Technique, label = value + " - " + mitre_technique_display
32+
| fields value, label
33+
| sort value</query>
34+
</search>
35+
<valueSuffix>"</valueSuffix>
36+
<prefix>(</prefix>
37+
<suffix>)</suffix>
38+
</input>
39+
</fieldset>
40+
<row>
41+
<panel depends="$ParallelCoordinatesInstalled$">
42+
<title>Splunk Detections/ATT&amp;CK Technique(s)/Atomic Tests Mapping</title>
43+
<viz type="parallel_coordinates_app.parallel_coordinates">
44+
<search>
45+
<query>| sseanalytics
46+
| fields mitre_id, name
47+
| mvexpand mitre_id
48+
| search $tokTechniques$
49+
| table mitre_id, name
50+
| lookup atomic-red-windows-tests "Technique #" AS mitre_id OUTPUT "Test Name" as test_name, "Test #" as test_no
51+
| eval label = mvzip(test_no, test_name, " - ")
52+
| fields mitre_id, name, label
53+
| mvexpand label
54+
| eval label = if(isnull(label) OR label=="", "&lt;NO TEST YET&gt;", label)
55+
| lookup purplesharp-techniques-lookup Technique as mitre_id OUTPUTNEW Technique as matched_technique
56+
| eval "Supported by PurpleSharp" = if(isnull(matched_technique), "No", "Yes")
57+
| fields - matched_technique
58+
| table name, mitre_id, "Supported by PurpleSharp", label
59+
| sort mitre_id, label, name
60+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique", name as "Splunk Security Detection", label as "Atomic Test Name"</query>
61+
<earliest>-24h@h</earliest>
62+
<latest>now</latest>
63+
</search>
64+
<option name="drilldown">none</option>
65+
<option name="parallel_coordinates_app.parallel_coordinates.colorMode">categorical</option>
66+
<option name="parallel_coordinates_app.parallel_coordinates.hideTicks">false</option>
67+
<option name="parallel_coordinates_app.parallel_coordinates.maxCategories">35</option>
68+
<option name="parallel_coordinates_app.parallel_coordinates.maxColor">#3fc77a</option>
69+
<option name="parallel_coordinates_app.parallel_coordinates.minColor">#006d9c</option>
70+
<option name="refresh.display">progressbar</option>
71+
</viz>
72+
</panel>
73+
<panel depends="$ParallelCoordinatesNotInstalled$">
74+
<html>
75+
<p>In order for this panel to show properly, please install the Parallel Coordinates visualization available <a href="https://splunkbase.splunk.com/app/3137">here</a>
76+
</p>
77+
</html>
78+
</panel>
79+
</row>
80+
<row>
81+
<panel>
82+
<title>Available Splunk Security Detections</title>
83+
<table>
84+
<search>
85+
<query>| sseanalytics
86+
| fields mitre_id, name, displayapp, dashboard
87+
| eval _SSE_url = "" + dashboard
88+
| mvexpand mitre_id
89+
| search $tokTechniques$
90+
| eval Link = "[View Details]"
91+
| table mitre_id, displayapp, name, Link, _SSE_url
92+
| sort mitre_id, name
93+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique", displayapp as "Source", name as "Security Detection"</query>
94+
<earliest>-24h@h</earliest>
95+
<latest>now</latest>
96+
</search>
97+
<option name="count">10</option>
98+
<option name="drilldown">row</option>
99+
<option name="refresh.display">progressbar</option>
100+
<drilldown>
101+
<link target="_blank">/app/Splunk_Security_Essentials/$row._SSE_url|n$</link>
102+
</drilldown>
103+
</table>
104+
</panel>
105+
<panel>
106+
<title>Available Atomic Red Tests</title>
107+
<table>
108+
<search>
109+
<query>| inputlookup atomic-red-windows-tests
110+
| eval name = 'Test #' + " - " + 'Test Name'
111+
| rename "Technique #" as mitre_id
112+
| search $tokTechniques$
113+
| fields mitre_id, name, "Test GUID"
114+
| eval Link = "[View Details]"
115+
| eval _mitre_id = mitre_id
116+
| sort mitre_id, name
117+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique", name as "Test Name"</query>
118+
<earliest>-24h@h</earliest>
119+
<latest>now</latest>
120+
</search>
121+
<option name="drilldown">row</option>
122+
<option name="refresh.display">progressbar</option>
123+
<drilldown>
124+
<link target="_blank">https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/$row._mitre_id|n$/$row._mitre_id|n$.md</link>
125+
</drilldown>
126+
</table>
127+
</panel>
128+
<panel>
129+
<title>PurpleSharp Supported Techniques</title>
130+
<table>
131+
<search>
132+
<query>| inputlookup purplesharp-techniques-lookup
133+
| rename "Technique" as mitre_id
134+
| search $tokTechniques$
135+
| rename mitre_id as "Att&amp;ck Technique/Sub Technique"
136+
| eval "Has related tests?" = "Yes"
137+
| appendpipe
138+
[ stats count
139+
| eval "Has related tests?"="None of the selected technique(s) have tests yet"
140+
| where count==0
141+
| table "Has related tests?"]</query>
142+
<earliest>-24h@h</earliest>
143+
<latest>now</latest>
144+
</search>
145+
<option name="drilldown">row</option>
146+
<option name="refresh.display">progressbar</option>
147+
<format type="color" field="Has related tests?">
148+
<colorPalette type="map">{"Yes":#53A051, "None of the selected technique(s) have tests yet":#FF0000}</colorPalette>
149+
</format>
150+
</table>
151+
</panel>
152+
</row>
153+
</form>

0 commit comments

Comments
 (0)