We’re happy to announce the release of Mission Control 3.0 which includes several new and exciting features made available to Splunk Enterprise Security Cloud users. The new features, detailed below, improve upon your user experience in Mission Control by helping you:  Simplify incident aggregation by consolidating related incidents for easier investigations with full context Seamlessly create incidents manually and add summary fields with multiple values Quickly access visualizations to better identify risk with a risk event timeline This release continues adding capabilities that unify security operations for Splunk users. We are bringing together your threat detection, investigation and response workflows into a common work surface. As a reminder, Mission Control is available for Splunk Cloud Enterprise Security Customers who are eligible for Mission Control today and it’s quick and simple to enable. Below are more details and screenshots of our latest release and you can find more details like release notes on our documentation site.  Simpler Incident Aggregation to Streamline Processes By merging related incidents using a parent/child view, you can minimize duplicate efforts, ensure accurate prioritization, and seamlessly inherit key attributes for streamlined processing. This feature is being released in a Preview version only.  Seamlessly Create Incidents Manually and Add Summary Fields with Multiple Values You now have the ability to add summary field information in the Mission Control UI. Many times you need to create incidents manually and set owner, status or other fields. Creating these incidents manually requires adding custom fields like “username”, which is now enabled in the UI with a new + button to add summary fields.  Quickly Access Visualizations To Better Identify Risk With A Risk Event Timeline Visualizations related to Risk Notables, like the interactive Risk Event Timeline, as well as the MITRE ATT&CK Matrix visualization, are quickly accessible within incidents in Mission Control.  For more information on Mission Control such as a product tour, demo videos, blog posts, white papers, and webinars, please visit our home page for Splunk Mission Control.  ... View more

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features made available to Splunk Enterprise Security Cloud users. The new features, detailed below, improve upon your user experience in Mission Control by:  Simplifying collaboration and note-taking within incidents Enabling faster investigations by improving load times and minimizing unnecessary refreshes Improving visibility into the value of your Splunk SOAR integration Enhancing the Threat Intelligence Management admin experience (for users in the AWS US East and US West regions today). Overall, this release continues the trajectory of Splunk Mission Control as a unified security operations application that brings together your threat detection, investigation and response workflows into a common work surface. As a reminder, Mission Control is available for all Splunk Enterprise Security Cloud users today and it’s quick and simple to enable the application. Below are more details and screenshots of our latest release and you can find more details like release notes on our documentation site.  Simpler Collaboration and Note-Taking  The notes and files features found within a response plan’s tasks are now available at the incident level, allowing greater collaboration and easier note taking. Access them within the side panel of your incident UI so that you can take notes while you peruse your other data.   Faster Task Completion with Dynamic UI Updates Tired of waiting for a spinner every time you update a task or change an incident’s status? Wait no more! With Mission Control’s dynamic UI updates you can now perform tasks in a fraction of the time with improved load times and a streamlined UX.  Improved Splunk SOAR Integration Visibility With improved visibility into your Splunk SOAR usage, you can learn more details instantly such as how many playbooks and actions you have run and how many connectors are being used. You can also see which playbook you are running the most and export usage reports if desired.  Easier Threat Intelligence Onboarding and Improved UX Several improvements to the Threat Intelligence Management admin experience (for ES Cloud users in the AWS US East and US West regions) have been released which allows you to save time as you more easily activate and deactivate your threat intelligence integrations within Mission Control.  For more information on Mission Control such as a product tour, demo videos, blog posts, white papers, and webinars, please visit our home page for Splunk Mission Control.  This post was co-authored by Kavita Varadarajan, Principal Product Manager for Splunk Mission Control. ... View more

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission Control, your SOC can detect, investigate and respond to threats from one modern, unified work surface, bringing order to the chaos of your security operations. In Mission Control, you'll have access to Splunk's industry-leading security technologies and partner ecosystem in one place. Solving Your Most Complex SOC Challenges Using Mission Control, you can solve the most pressing security operations challenges for your team. First, it helps resolve the problem of detection, investigation and response being spread across siloed tools while security insights are diffused across interfaces, making it difficult to achieve intelligent situational awareness. Secondly, it helps guide your teams through scattered SOC procedures and dispersed data across multiple systems. Finally, you can shift to a more proactive mode and preempt fatigue by getting past the never ending detections and manual processes. Taking Your SOC to the Next Level Mission Control not only automates security operations, but also unifies detection, investigation, and response capabilities to empower your security operations team. With Mission Control, you can streamline your security workflows with response templates and modernize your security operations with automation. Here are some specific capabilities you receive with Mission Control: Scalable security analytics See a single queue of all your high-fidelity incidents consisting of your prioritized risk notables. Stop attacks fast with automated analysis of complex attack chains. Standardized SOC processes Speed up investigations with pre-built OOTB response templates that include embedded searches, actions and playbooks to empower security analysts. Orchestration, automation and response Launch SOAR playbooks and actions without leaving the console. Plug and play with the integrations you need across your use cases. Case management Use response templates to add custom notes, intelligence data and relevant files to document work within an investigation. Metrics and reporting Reference historical data from your response template tasks to deliver detailed SOC metrics, reporting and auditability. Integrated intelligence enrichment* Fully investigate security events or suspicious activity by accessing the relevant and normalized intelligence to better understand threat context. (*regional limitations may apply)   Getting Started Eligible users of Splunk Enterprise Security Cloud will be able to access Mission Control in just a few clicks once Mission Control is available on your stack. In the coming weeks, if you are an eligible user, you will be able to find Mission Control in the Splunk Apps dropdown as an available application. From there, it’s just a simple click to enable Mission Control and you’re off to the races!    If you want to learn more about Mission Control, please check out our updated web page and docs site. Stay tuned as we will also be posting more demo videos, blog posts, and content in Lantern to help you get started.  ... View more