Outcomes NavigatorOutcomes Navigator Release Notes

MITRE ATT&CK^® Framework Integration

You can now use Outcomes Navigator from a MITRE ATT&CK perspective. Explore all MITRE ATT&CK tactics and techniques and determine which ones your configuration should focus on to achieve your goals, assess how well your configuration protects against a specific MITRE ATT&CK technique, and view recommendations to improve your configuration. You can also quickly understand the efficacy of your configuration to protect against an MITRE ATT&CK technique using the MITRE ATT&CK Coverage Score.

Custom Dashboards Assessment

The assessment for Dashboards coverage now includes your custom dashboards. The coverage level from None to Best now also reflects custom dashboards and you can now view the custom dashboards your configuration makes operational in the Organizational Coverage tab. Custom dashboards are also included in Use Case Coverage Score and MITRE ATT&CK Coverage Score calculations.

MITRE ATT&CK^® Terminology Updates

To better adhere to MITRE ATT&CK^® naming guidelines, references to products and features have been updated throughout Outcomes Navigator. These changes include:

Hidden MITRE ATT&CK^® Techniques and Use Cases

To focus only on your goals, on the Explore Exabeam Content Through These Portals page, you can now hide use cases and MITRE ATT&CK techniques that are irrelevant to your goals. Once hidden, you can toggle the view to show or hide hidden use cases or MITRE ATT&CK techniques.

Outcomes Navigator General Availability

Outcomes Navigator is now generally available to all users.

Satisfied Metric for Correlation Rules Coverage

You can now determine whether correlation rules have all fields they require to trigger. These correlation rules are considered satisfied. On the Organizational Coverage tab, under <Use Case> Outcomes, click View Correlation Rules. View whether a rule is satisfied or unsatisfied under the ALL FIELDS SEEN column.

Conditions in Advanced AnalyticsRules and Correlation Rules Coverage Calculation

General: Advanced Analytics rules and Correlation Rules coverage now consider conditions when calculating coverage.

Weekly Coverage Over Time

You can now easily review weekly trends in the Use Case Coverage Score. In the Organizational Coverage tab, you can now switch the Coverage Over Time chart to show the Use Case Coverage Score for the past six weeks. 

Product Parsing Action Status

Follow a workflow to identify and investigate parsing issues. After investigating any parsing issues, you can now mark the product as reviewed and remove it from the recommended products to review.

Satisfied Metric for Advanced Analytics Rules Coverage

You can now determine whether Advanced Analytics rules have all fields they require to trigger. These Advanced Analytics rules are considered satisfied. On the Organizational Coverage tab, under <Use Case> Outcomes, click View Advanced Analytics Rules. View whether a rule is satisfied or unsatisfied under the ALL FIELDS SEEN column.

Link to Parser Manager in Recommendations

You can now navigate directly to Log Stream Parser Manager from Outcomes Navigator to investigate products with a low Parser Calibration Tier Average. On the Recommendations tab for each use case, under Ensure these products are at Parser Calibration Tier 1 or 2, click Improve for the product you want to investigate. Parser Manager opens and filters for parsers related to the product.

Advanced Analytics Rules Coverage Enablement Assessment

You can now view which Advanced Analytics rules are enabled or disabled in Outcomes Navigator. On the Organizational Coverage tab, under <Use Case> Outcomes, click View Advanced Analytics Rules. View whether a rule is enabled or disabled under the Enabled column.