Aggregate risk attributions with the Analyze ES Risk Attributions dashboard

The Analyze ES Risk Attributions dashboard helps you understand the data provided by the Splunk Enterprise Security Risk Analysis Framework. The ES Risk Attributions dashboard looks at the content in the ES Risk Framework with default risk aggregations. It includes a customized MITRE ATT&CK Matrix based on your search filters which lets you see what techniques have been seen against a particular user, host, or network. You can enter any search string to use the dashboard to analyze a network or your entire organization.

Aggregating risk attributions is the core strength of this dashboard, and there is a series of charts that aggregate risk by various metrics.This dashboard also shows system wide metrics and information, many of which are focused on MITRE ATT&CK. For more information on MITRE ATT&CK, see The MITRE ATT&CK Framework dashboard.

There is also a straightforward sum of risk by object, which will let you see which objects are experiencing the greatest amount of risk.