Description

The dashboard shows errors for some panels and seems to expect lookups that don't seem to be provided as part of this Github/app.

When Show Attack Web is selected, a similar error is displayed:

Related links

• Issue

Description

The following error exists when using the risk attributions dashboard

The lookup table 'attack_web_viz' does not exist or is not available.

Related links

https://splunk.github.io/rba/dashboards/risk_attributions/
https://github.com/apger/SA-RBA/blob/master/lookups/attack_web_viz.csv

Proposed change (optional)

No response

Description

The attack_matrix_risk.xml dashboard seems to rely (?) on CSS and/or Javascript files that do not seem to be included in this repo.
Can we remove them (if no longer needed) or re-add them?

Related links

• Issue

Description

The dashboard seems to have a few issues, for example:

• Panels are not restricted to Risk Rules, for example, It shows an incorrect count of detections populating the Risk index (which should have the Risk Analysis action enabled), etc. Maybe add AND match('actions',"risk") to the filter of the base search?
• MITRE extractions (from search?) seem to be broken. Might want to get those from annotations?
• The dashboard might benefit from simplifying the base search to:

| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches 
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") 
| where disabled=0

... and putting additional logic in the relevant panel search. Otherwise the base search extracts fields that might never be used.

• The | rest call above could be further optimized by explicitly requesting only the necessary fields, i.e.: | rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches f=field1 f=field2 f=field3

I'm happy to help fix those if that makes sense.

Related links

• Issue

Description

Add a new version for Deduplicating risk events.

https://www.gabrielvasseur.com/post/rba-a-better-way-to-dedup-risk-events

Related links

• Add version two to existing Docs

Description

This was raised by John Norton on the Outpost Security RBA Slack channel. See screenshot.
This comes from using tstats on two related MV fields that have to be joined in order.

Description

Please add version="1.1" to dashboards where it's missing from the <form> tag.

Related links

• Issue