EDR evaluation app for Splunk

This app for Splunk accompanies two blog posts about the MITRE ATTACK Endpoint Detection and Response (EDR) results for:

It shows data and dashboards from the JSON data published in the MITRE ATTACK evaluations

Why does this Splunk app exist?

To make it easier to play with the EDR evaluation results. The JSON files from MITRE weren't that friendly for slicing and dicing in Splunk, so I wrote a Python script to transpose them for APT3 and APT29 here, and included that data in this app for onboarding in Splunk.

How do I use this app?

Install from Splunkbase (or git clone from Github, if you download the .zip file please remember to rename the directory to "EDRevals")
Look at the dashboards and draw your own conclusions
If unsatisfied, create your own queries
(Optionally drop me a line about your own query adventures.)