icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading MITRE ATTCK Heatmap for Splunk
SHA256 checksum (mitre-attck-heatmap-for-splunk_110.tgz) d4143c91cd475e715ed0b91f57de7914711b251dbdcbb6b280e28ae1e2ffae78 SHA256 checksum (mitre-attck-heatmap-for-splunk_100.tgz) 3fa238ce03894cf144c4c0560979fe353e5be22b247e8208b1b2be196e959874
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

splunk

MITRE ATTCK Heatmap for Splunk

Splunk Cloud
Overview
Details
Custom Visualizations give you new interactive ways to visualize your data during search and investigation, and to better communicate results in dashboards and reports. After installing this app you'll find a MITRE ATT&CK Heatmap diagram as an additional item in the visualization picker in Search and Dashboard.

This app uses Enterprise ATT&CK v9. For more information visit https://attack.mitre.org/versions/v9/

For further documentation visit https://github.com/alatif113/mitre_attck_heatmap

MITRE ATT&CK® Heatmap

Custom Visualizations give you new interactive ways to visualize your data during search and investigation, and to better communicate results in dashboards and reports. After installing this app youll find a MITRE ATT&CK Heatmap diagram as an additional item in the visualization picker in Search and Dashboard.

This app uses Enterprise ATT&CK v9. For more information visit https://attack.mitre.org/versions/v9/

For further documentation visit https://github.com/alatif113/mitre_attck_heatmap

Usage

Search Query

| table <att&ck_technique_id> <numerical_value> [description]

OR

| stats <aggregation> by <att&ck_technique_id>

The visualization requires at least 2 fields to be present within the search output, with an optional third:
1. att&ck_technique_id: The ID of a MITRE ATT&CK Technique (e.g. T0001)
2. numerical_value / aggregation: A numerical value or aggregation to associate with the technique (e.g. count, sum, average)
3. (Optional) descroption: An optional description to associate with the technique, to display within a tooltop on mouse hover.

Note: The visualization has been developed for dark mode. Light mode will be supported in a future version.

Example search query

| stats count AS "Detection Count" first(description) as description by id
| table id "Detection Count" description

Support

This app is currently unsupported for Internet Explorer.

LICENSE from the MITRE Corporation (MITRE)

Both MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.

The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK Evaluations for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

"(C) 2018 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

DISCLAIMERS
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Release Notes

Version 1.1.0
Sept. 15, 2021
  • Various updated to pass Splunk app-inspect for Splunk Cloud
Version 1.0.0
Sept. 13, 2021
23
Installs
53
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.