Encounter error on MITRE Dashboard in Splunk Security Essentials "ATT&CK version:undefined".

Applicability

Description

In the MITRE ATT&CK Framework dashboard within Splunk Security Essentials, MITRE ATT&CK Matrix data is not loading.

Investigation

1. Go to Apps > Splunk Security Essentials > Analytics Advisor > MITRE ATT&CK Framework

2. Click on the escalation mark to check the error in the SSE MITRE ATT&CK Dashboard and the below error can be found.

"External search command 'mitremap' returned error code 1. Script output = "Error! "{""status"": ""ERROR"", ""description"": ""Error occurred reading enterprise-attack.json"", ""message"": ""'objects'""}" "." 

This issue has been reported and will be addressed in the upcoming release of Splunk Security Essential.

Resolution

The app can be rolled back to the previous version or wait for the upcoming release. Fixed bugs will be documented in the release notes in the Splunk documentation.

Refer to the below link to check the latest version and release notes of SSE.
Splunk Security Essentials: Splunk Base