Splunk Security Content | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" | rest /services/configs/conf-analyticstories splunk_server=local count=0 |search eai:acl.app = "DA-ESS-ContentUpdate" * * * *

Explore Splunk Security Content using Splunk Enterprise Security

Total Analytic Stories search title="analytic_story://*" |stats count Total Detections stats count by action.correlationsearch.label| eventstats sum(count) as total_detection_count| fields total_detection_count ESCU App Version | rest /services/configs/conf-content-version splunk_server=local count=0 | table version Story Categories | rest /services/configs/conf-analyticstories splunk_server=local count=0 | search eai:acl.app = "DA-ESS-ContentUpdate"| search title="analytic_story://*"| stats count by category $click.value$ $click.value$ Analytic Stories by MITRE Technique ID | rest /services/saved/searches splunk_server=local count=0 | search title="ESCU - *" | spath input=action.correlationsearch.annotations path=mitre_attack{} output="MITRE Technique ID" | spath input=action.correlationsearch.annotations path=analytic_story{} output=story_name | stats dc(story_name) as "Analytic Stories" by "MITRE Technique ID" $click.value$ $click.value$ All now | rest /services/configs/conf-savedsearches splunk_server=local count=0 | search action.escu.search_type = detection | spath input=action.correlationsearch.annotations path=analytic_story{} output="story" | mvexpand story | dedup story | fields story story story * " " * Analytic Story Details | rest /services/configs/conf-savedsearches splunk_server=local count=0 | search action.escu.search_type = detection | spath input=action.correlationsearch.annotations path=analytic_story{} output="analytic_story" | spath input=action.correlationsearch.annotations path=mitre_attack{} output="mitre_attack" | spath input=action.escu.data_models path={} output="Data Models" | rename title as "Detections" | join analytic_story [| rest /services/configs/conf-analyticstories splunk_server=local count=0 | search title="analytic_story://*" | eval "analytic_story"=replace(title,"analytic_story://","" ) ] | search analytic_story= $story$ |stats values(Detections) as Detections values(mitre_attack) as "MITRE Technique ID" values(last_updated) as "Last Updated" by analytic_story description| rename analytic_story as "Analytic Story"| rename description as Description| table "Analytic Story" Description Detections "MITRE Technique ID" "Last Updated" $earliest$ $latest$