Share Splunk Mission Control data usage in Splunk Enterprise Security

When you deploy Splunk Enterprise Security version 8.0 on Splunk Enterprise, the Splunk platform sends anonymized Splunk Mission Control usage data to Splunk Inc. ("Splunk") to help improve Splunk Enterprise Security in future releases. For information about how to opt in or out, and how the data is collected, stored, and governed, see Share data in Splunk Enterprise.

How data is collected

Splunk Mission Control uses saved searches to collect anonymous usage data. These searches run in the background regardless of whether or not you opt-in to send usage data to Splunk, and do not have any significant impact on performance.

What data is collected

Splunk Mission Control collects the following basic usage information:

Name Description Example
app.MissionControl.active_users Count of unique users accessing any views in the app.
JSON 
app: missioncontrol
   begin: 1657929600
   component: app.MissionControl.active_users
   data: { [-]
     admin_count: 3
     count: 4
   }
   datetime: 07-17-2022 04:11:18.749 +0000
   deploymentID: CLOUD-00eddb5e-8dcf-560a-a6f2-ec09bed65be7
   end: 1658016000
   environment: stg
   eventID: 6CDDC009-F01B-4A46-BBD2-4CBC7C5FADF3
   executionID: B7BDBBB1-399C-4B52-8EEC-F379323923B0
   optInRequired: 3
   stackID: 02e2d57eed3eb47a145cdd6faa72560699655114455afe9e7e8be6062a2b6554
   timestamp: 1658030580
   type: aggregate
   version: 1.0
   visibility: anonymous
app.MissionControl.configuration General configuration states of the app.
JSON 
app: missioncontrol
   component: app.MissionControl.configuration
   data: { [-]
     accepted: 1
   }
   datetime: 07-18-2022 04:21:19.637 +0000
   deploymentID: CLOUD-00eddb5e-8dcf-560a-a6f2-ec09bed65be7
   environment: stg
   eventID: 6AB73C72-1B31-4404-B001-7712DBA5083B
   executionID: 7DBF4251-C106-4020-A116-B0D40EBA605F
   optInRequired: 3
   stackID: 02e2d57eed3eb47a145cdd6faa72560699655114455afe9e7e8be6062a2b6554
   timestamp: 1658117562
   type: aggregate
   version: 1.0
   visibility: anonymous
app.MissionControl.incidents Count of incidents created in the last 24 hours and metadata about them.
JSON 
app: missioncontrol
   begin: 1658016000
   component: app.MissionControl.incidents
   data: { [-]
     has_notable_count: 192
     incidents_count: 192
     incidents_with_response_plans: 192
   }
   datetime: 07-18-2022 04:15:07.575 +0000
   deploymentID: CLOUD-d112a64c-6205-56c6-95b9-d641ca11a5ab
   end: 1658102400
   environment: stg
   eventID: CE611F3D-8E50-4712-AC1B-F880D286D2B1
   executionID: E8FB4DAB-A436-4AB7-853A-5FEBDA969A90
   optInRequired: 3
   stackID: 942d2b1e14de8665c6e25ce18209ae61eb30026e9576af52120896b209a3e6e6
   timestamp: 1658117268
   type: aggregate
   version: 1.0
   visibility: anonymous
app.MissionControl.responseplans Statistics about the count of response plans per incident.
JSON 
app: missioncontrol
   component: app.MissionControl.responseplans
   data: { [-]
     avg_response_plans_per_incident: 1.4285714285714286
     max_response_plans_per_incident: 2
     min_response_plans_per_incident: 1
   }
   datetime: 07-16-2022 04:25:05.005 +0000
   deploymentID: CLOUD-d112a64c-6205-56c6-95b9-d641ca11a5ab
   environment: stg
   eventID: 2A92B5A9-3BF7-485E-BE12-A76E591B3B52
   executionID: 75CE7772-2769-42E7-9ABB-114F3858F23E
   optInRequired: 3
   stackID: 942d2b1e14de8665c6e25ce18209ae61eb30026e9576af52120896b209a3e6e6
   timestamp: 1657945349
   type: aggregate
   visibility: anonymous
app.MissionControl.responseplanstasks Statistics about the count of tasks per response plan.
JSON 
app: missioncontrol
   component: app.MissionControl.responseplantasks
   data: { [-]
     avg_tasks_count_in_response_plan: 19.413686534216335
     max_tasks_count_in_response_plan: 28
     min_tasks_count_in_response_plan: 9
   }
   datetime: 07-17-2022 04:27:20.126 +0000
   deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35
   environment: stg
   eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A
   executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90
   optInRequired: 3
   stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b
   timestamp: 1658032031
   type: aggregate
   visibility: anonymous
app.session.MissionControl.splSuccess Metadata about successful SPL queries triggered by the UI to power features in the app.
JSON 
component: app.session.MissionControl.splSuccess
   data: { [-]
     action: searchResults.load
     app: missioncontrol
     executionTime: 4275.5
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     searchMacro: | `mc_incidents`
     sessionID: e16ae6b4-e407-4238-8bcb-a08aa05232ab
   }
   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb
   eventID: 23792757-d7b1-0bf3-3329-68383fc0675f
   experienceID: f4c99b71-d781-9569-3eb4-a2306cde9a7c
   optInRequired: 3
   splunkVersion: 9.0.0
   timestamp: 1658189286
   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33
   version: 4
   visibility: anonymous,support
app.session.MissionControl.splError Metadata about errors when making SPL queries from the UI.
JSON 
component: app.session.MissionControl.splError
   data: { [-]
     action: searchResults.error
     app: missioncontrol
     executionTime: 34.39999997615814
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     searchMacro: | `mc_incidents`
     sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b
   }
   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb
   eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c
   experienceID: b26453d2-6630-784f-3624-98360be1e98e
   optInRequired: 3
   splunkVersion: 9.0.0
   timestamp: 1658188621
   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33
   version: 4
   visibility: anonymous,support
app.session.MissionControl.pageView UI user access to sub-routes within the app.
JSON 
component: app.session.MissionControl.pageView
   data: { [-]
     app: missioncontrol
     page: investigation/response
     pathname: /en-US/app/missioncontrol/mc_incident_review
     sessionID: 4775fa3c-ad77-4778-ac18-054c6d5ef120
   }
   deploymentID: 5b0290bb-60fa-56eb-bd31-7a2b730c813a
   eventID: 78ff506d-ecda-d879-1aff-9516fb4e6cca
   experienceID: a1c94be3-aa5a-f047-8b75-b912125c6846
   optInRequired: 3
   timestamp: 1658188399
   userID: 31b17c1d977a2df05a722cf9d9cc64cd66abf07776e107da51b9061bce07ec2f
   version: 4
   visibility: anonymous,support
app.session.MissionControl.uiError Any errors caught by the UI JavaScript code.
JSON 
component: app.session.MissionControl.uiError
   data: { [-]
     app: missioncontrol
     error: Error: Unexpected error to get response templates
     errorType: errorBoundary
     page: mc_content
     pathname: /en-US/app/missioncontrol/mc_content
     sessionID: 3ce56857-84a2-4a53-9d14-1ab4328829af
     stackTrace: Error: Unexpected error to get response templates at ResponseTemplatesTable (webpack-internal:///./src/features/ResponseTemplates/templateListView/ResponseTemplatesTable.tsx:31:11) at renderWithHooks (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:14803:18) at updateFunctionComponent (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:17034:20) at beginWork (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:18610:16) at HTMLUnknownElement.callCallback (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:188:14) at Object.invokeGuardedCallbackDev (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:237:16) at invokeGuardedCallback (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:292:31) at beginWork$1 (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:23203:7) at performUnitOfWork (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:22157:12) at workLoopSync (webpack-internal:///../../node_modules/react-dom/cjs/react-dom.development.js:22130:22)
   }
   deploymentID: 0bcca5d4-9af8-5f22-9899-7e463be6bac8
   eventID: ab67c7cd-bc07-c6f5-eb87-916c46480611
   experienceID: 59b8518a-3f68-06f5-c61f-73e8b6fb3c7e
   optInRequired: 3
   timestamp: 1658186683
   userID: 43bdc924ec0181df08203c5094df121ba564d7d44017898753f9a744231d684f
   version: 4
   visibility: anonymous,support
app.session.MissionControl.searchChange Tracking how users are using the custom search feature on the Incident Review page.
JSON 
component: app.session.MissionControl.searchChange
   data: { [-]
     action: searchForIncidents.change
     app: missioncontrol
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     sessionID: 099c92d2-f1ba-490f-873e-2bbfe9cc0f49
   }
   deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f
   eventID: 1c5ca745-6a6d-3b5c-7a2c-c710fe1f80b1
   experienceID: 293f92a2-b1ba-08a9-1f73-6b5e74884cb7
   optInRequired: 3
   timestamp: 1658180323
   userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd
   version: 4
   visibility: anonymous,support
app.session.MissionControl.dateTimeFilterChange Tracking how users are using the data-range picker in the Incident Review page.
JSON 
component: app.session.MissionControl.dateTimeFilterChange
   data: { [-]
     action: saveDateTimeRange.change
     app: missioncontrol
     dateTimeFilter: { [-]
       earliest: -30d@d
       latest: now
     }
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     sessionID: 068474a2-96d0-4b7a-a86f-9511439224c1
   }
   deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f
   eventID: cb981a04-1079-31a9-edd6-85597d7fb99f
   experienceID: 32080c9e-d599-ba82-ad93-1ee099c04fdf
   optInRequired: 3
   timestamp: 1658186091
   userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd
   version: 4
   visibility: anonymous,support
app.session.MissionControl.previewClick Tracking how users are using the Preview feature in Incident Review.
JSON 
component: app.session.MissionControl.previewClick
   data: { [-]
     action: previewIncident.click
     app: missioncontrol
     incidentId: 80391c34-c26e-45ef-b47d-6966b8e52539
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     sessionID: 967af740-baa1-4348-be94-012b70b1d8d4
   }
   deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f
   eventID: c60cc63b-eaeb-4422-e4ea-61fd5c08c17a
   experienceID: 6409f66e-a7a9-168f-85f3-ecc8fe8d009b
   optInRequired: 3
   timestamp: 1658183313
   userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd
   version: 4
   visibility: anonymous,support
app.session.MissionControl.sortClick Tracking how users are sorting the table of Incidents in Incident Review.
JSON 
component: app.session.MissionControl.sortClick
   data: { [-]
     action: sortIncidentReviewTable.click
     app: missioncontrol
     field: update_time
     order: asc
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     sessionID: c1900ee7-3413-410f-a415-f68e71a098dc
   }
   deploymentID: ce48e2e4-155f-5b76-8a41-cbae3ba1ae0f
   eventID: da35cefa-a455-43b3-f302-009b610a2d96
   experienceID: 189df09f-6e4b-4378-91eb-222a6b43e387
   optInRequired: 3
   timestamp: 1658179213
   userID: 4e0b955955b5623d11236342c14ae1cdf6dd7b59f1ddc4e65dda002ebd22e6fd
   version: 4
   visibility: anonymous,support
app.session.MissionControl.responsePlanTaskEnded Tracking whenever response plan tasks are completed by a user.
JSON 
app: splunk_instrumentation
   component: app.session.MissionControl.responsePlanTaskEnded
   data: { [-]
     action: taskStatus.ended
     app: missioncontrol
     incidentId: f5aa0b6a-3ce3-4c74-9177-6de9033c3d6d
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     planId: cbba8ce9-a37a-4922-bc02-c901481fc29b
     sessionID: f10d73be-a333-4e9a-b1be-57957fbba7cb
     taskId: bc2a52f7-e0d3-4203-bcbe-80df22031207
   }
   datetime: 07-18-2022 22:41:46.889 +0000
   deploymentID: CLOUD-a3298e8a-4ab4-53a0-88ab-01870a1797a4
   environment: stg
   eventID: 8F621DFE-4BB9-4D62-A22A-E11D9F7D4712
   executionID: 93E6EB60-DDE7-4032-882F-6AD68CFAC0B7
   experienceID: d1cb88b3-eb72-fdb9-3c90-d0eb849b595d
   optInRequired: 3
   stackID: 5f078bb7147e221aebe8e093aecab8bbe672753cedbd124f3e85d57a612a90df
   timestamp: 1658183567
   type: event
   userID: 108c7b6692d0cebb61dbcc4197f4c054e920a8895148c6a99a96b25a925a1e18
   visibility: anonymous
app.MissionControl.CustomField_Create Count of custom fields created.
JSON 
{ [-]
   app: missioncontrol
   component: app.MissionControl.CustomField_Create
   data: { [-]
     customfield_count: 1
   }
   datetime: 10-21-2022 23:49:39.933 +0000
   deploymentID: CLOUD-ce4f0656cd7c7cdd704382e85fe70f2e8d41c1231aa081af74db075bcf91492c
   environment: stg
   eventID: 0DD12999-3DB2-4940-B7DB-B63F99355028
   executionID: 87B93925-7E7D-4FD9-A28E-2CCD2D52722F
   optInRequired: 3
   stackID: ce4f0656cd7c7cdd704382e85fe70f2e8d41c1231aa081af74db075bcf91492c
   timestamp: 1666396175
   type: event
   userID: 1322faf308e988b9c4bbb7d0658eb1a92e96b10f48b7728e40840181f3149587
   visibility: anonymous,support
}
app.MissionControl.Event_List Statistics about the amount and duration of searches when listing events.
JSON 
{ [-]
   app: missioncontrol
   component: app.MissionControl.Event_List
   data: { [-]
     search_count: 1
     search_job_elapsed_time: 1666222229
   }
   datetime: 10-19-2022 23:39:12.566 +0000
   deploymentID: CLOUD-9437d510aabac6b49866573de6a838fd4a5b3f5a67fea20e11ac46de9c33b6b2
   environment: stg
   eventID: 9563EB2E-5DE9-4D37-968A-0CA7E630EA40
   executionID: 24D2F783-2777-4FDC-8467-1A1567958D1B
   optInRequired: 3
   stackID: 9437d510aabac6b49866573de6a838fd4a5b3f5a67fea20e11ac46de9c33b6b2
   timestamp: 1666222234
   type: event
   userID: d220d7796e330cb5f52fdecaaa840512f51a4c924318ac3536a4ff37a235452b
   visibility: anonymous,support
}
app.session.rum.mark UI performance metrics.
JSON 
{
   app: splunk_instrumentation
   component: app.session.rum.mark
   data: { [-]
     aggregatedTimings: { [-]
       appserver: { [-]
         dns: 0
         load: 0.5
         processing: 3622.399999976158
         redirect: 0
         request: 851.5
         response: 4.199999988079071
         tcp: 0
         totalRequests: 5
       }
       other: { [-]
         dns: 0
         load: 0
         processing: 0
         redirect: 0
         request: 0
         response: 5180.199999988079
         tcp: 0
         totalRequests: 1
       }
       splunkd: { [-]
         dns: 0
         load: 0
         processing: 0
         redirect: 0
         request: 5019.4000000059605
         response: 673.5999999642372
         tcp: 0
         totalRequests: 36
       }
       static-asset: { [-]
         dns: 0
         load: 0
         processing: 0
         redirect: 0
         request: 2214.800000011921
         response: 3604.4999999403954
         tcp: 82.90000000596046
         totalRequests: 19
       }
     }
     app: missioncontrol
     context: { [-]
     }
     firstContentfulPaint: 3259.5999999940395
     firstPaint: 847.9000000059605
     hero: IncidentReview-TimeToInteractive
     navigationTimings: { [-]
       dns: 0
       load: 0.5
       processing: 3622.399999976158
       redirect: 0
       request: 316.40000000596046
       requestType: appserver
       response: 0.7999999821186066
       tcp: 0
     }
     page: mc_incident_review
     sourceLocation: IncidentListMounted
     timeSinceOrigin: 5356.299999982119
     transactionId: cdb0a550-a33a-11ed-8089-556e41c09736
   }
   datetime: 02-02-2023 20:53:27.710 +0000
   deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   environment: stg
   eventID: 3EC8DAC5-25CD-49C6-B339-F45F03DF63EA
   executionID: 4429B60C-4B5F-43DB-A035-FFFB58E673BE
   experienceID: 92d8db2e-f7a4-7a59-002f-4e93618d675f
   optInRequired: 3
   stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   timestamp: 1675370848
   type: event
   userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7
   visibility: anonymous,support

}
app.session.rum.measure UI performance metrics.
JSON 
{   [-]
   app: splunk_instrumentation
   component: app.session.rum.measure
   data: { [-]
     app: missioncontrol
     context: { [-]
     }
     duration: 7134.9000000059605
     fromSourceDurations: { [-]
       IncidentListMounted: 5865.800000011921
       IncidentReview-TimeToInteractive: 0
     }
     fromSourceLocation: origin
     hero: IncidentReview-TimeToInteractive
     page: mc_incident_review
     timeSinceOrigin: 7134.9000000059605
     toSourceLocation: IncidentReview-TimeToInteractive
     transactionId: 425f8e70-a33b-11ed-bb34-4f3de3099440
   }
   datetime: 02-02-2023 20:53:27.708 +0000
   deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   environment: stg
   eventID: A4E24B3A-3CB4-4003-B9D3-A7C743AB2650
   executionID: 4429B60C-4B5F-43DB-A035-FFFB58E673BE
   experienceID: 92d8db2e-f7a4-7a59-002f-4e93618d675f
   optInRequired: 3
   stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   timestamp: 1675371049
   type: event
   userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7
   visibility: anonymous,support
}
app.session.MissionControl.responsePlanSoarAutomationClicked Type of automation executed in response plan.
JSON 
{  

   app: splunk_instrumentation

   component: app.session.MissionControl.responsePlanSoarAutomationClicked

   data: { [-]
     app: missioncontrol
     incidentId: 85119140-8f70-4442-b2c9-6f97a9d43a15
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     phaseId: 4e5ac75f-6570-42bb-ab98-0a69363e5a8e
     sessionID: 17eb54e3-d007-48ac-8e75-0d4e7bc6d57b
     taskId: a3d372fa-c08c-43cf-b043-cd1d9bf55e9c
     type: action
   }

   datetime: 01-18-2023 00:33:30.240 +0000

   deploymentID: CLOUD-c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba

   environment: stg

   eventID: 55D8C86A-1204-4CA1-9484-DFFD90A018F2

   executionID: 04D37357-D55F-4508-9CB0-85285154ACF9

   experienceID: 9c06a211-3333-d7fa-c7c9-bec30487fd49

   optInRequired: 3

   stackID: c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba

   timestamp: 1674001689

   type: event

   userID: fde510d805fa7761ce2a5cfb1c8c3df7feafc5efc76b4a6eac9c42c2fbc1527a

   visibility: anonymous,support

}

{

   app: splunk_instrumentation

   component: app.session.MissionControl.responsePlanSoarAutomationClicked

   data: { [-]
     app: missioncontrol
     incidentId: 85119140-8f70-4442-b2c9-6f97a9d43a15
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     phaseId: 4e5ac75f-6570-42bb-ab98-0a69363e5a8e
     sessionID: 17eb54e3-d007-48ac-8e75-0d4e7bc6d57b
     taskId: a3d372fa-c08c-43cf-b043-cd1d9bf55e9c
     type: playbook
   }

   datetime: 01-18-2023 00:33:30.239 +0000

   deploymentID: CLOUD-c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba

   environment: stg

   eventID: B76AD1CA-E2AB-475C-850E-62CA43514871

   executionID: 04D37357-D55F-4508-9CB0-85285154ACF9

   experienceID: 9c06a211-3333-d7fa-c7c9-bec30487fd49

   optInRequired: 3

   stackID: c1f24f272b6470307e036645664e808da01067974ba94b8c0500b7e93b4a2bba

   timestamp: 1674001741

   type: event

   userID: fde510d805fa7761ce2a5cfb1c8c3df7feafc5efc76b4a6eac9c42c2fbc1527a

   visibility: anonymous,support

}
app.MissionControl.Create_Event Count of events created.
JSON 
{ [-]
   app: missioncontrol
   component: app.MissionControl.Event_Create
   data: { [-]
     event_count: 1
   }
   datetime: 02-07-2023 04:58:43.879 +0000
   deploymentID: CLOUD-cdfed0ab-9747-565c-a1d4-8528229c12fd
   environment: stg
   eventID: 98EFFB40-FE33-4832-BACC-BA5C4EA55C55
   executionID: F5DB7E28-4058-4FAC-9547-9C77B6D1466D
   optInRequired: 3
   stackID: 42f14a7e5f105d309cd5f2d25c2f7be636528f650c98a6cf6d912865dafe799d
   timestamp: 1675745811
   type: event
   userID: 4cf0aa1fb38229445505da09968087abab3b97f210b9254ae527f907a0d2e3b9
   visibility: anonymous

}
app.MissionControl.Delete_Event Count of events deleted.
JSON 
{ [-]
   app: missioncontrol
   component: app.MissionControl.Event_Delete
   data: { [-]
     event_count: -1
   }
   datetime: 02-07-2023 20:11:17.700 +0000
   deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   environment: stg
   eventID: 6C33A16E-39C0-48E7-B7E2-3201B1BC8D8A
   executionID: D16CC7B3-20F5-409A-8F19-CEA2382EB1EF
   optInRequired: 3
   stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   timestamp: 1675800526
   type: event
   userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7
   visibility: anonymous,support

}
app.MissionControl.fileUploadedIncident File name and size.
JSON 
app: missioncontrol
   component: app.MissionControl.fileUploadedIncident
   data: { [-]
     size: 1024
   }
   datetime: 07-17-2022 04:27:20.126 +0000
   deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35
   environment: stg
   eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A
   executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90
   optInRequired: 3
   stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b
   timestamp: 1658032031
   type: aggregate
   visibility: anonymous
app.MissionControl.fileUploadedTask File name and size.
JSON 
app: missioncontrol
   component: app.MissionControl.fileUploadedTask
   data: { [-]
     size: 1024
   }
   datetime: 07-17-2022 04:27:20.126 +0000
   deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35
   environment: stg
   eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A
   executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90
   optInRequired: 3
   stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b
   timestamp: 1658032031
   type: aggregate
   visibility: anonymous
app.MissionControl.fileDownloaded File name and size.
JSON 
app: missioncontrol
   component: app.MissionControl.fileDownloaded
   data: { [-]
     size: 1024
   }
   datetime: 07-17-2022 04:27:20.126 +0000
   deploymentID: CLOUD-2cc191a3-94a8-54a0-b390-63b5665fad35
   environment: stg
   eventID: 6FDC1B28-9B83-4C7D-A1D6-E9373ECF196A
   executionID: 34ABCD8B-7F61-46F1-966F-6ACFA6FD5F90
   optInRequired: 3
   stackID: ac88a9ea1646570463f40ec2e929581bfc3fae4380d1d936c0346a292ac8a25b
   timestamp: 1658032031
   type: aggregate
   visibility: anonymous
app.session.MissionControl.splPreviewSuccess Metadata about successful SPL Preview results triggered by the UI to power features in the app.
JSON 
component: app.session.MissionControl.splPreviewSuccess

   data: { [-]
     action: searchResultsPreview.load
     app: missioncontrol
     executionTime: 4275.5
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     searchMacro: | `mc_incidents`
     sessionID: e16ae6b4-e407-4238-8bcb-a08aa05232ab
   }

   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb

   eventID: 23792757-d7b1-0bf3-3329-68383fc0675f

   experienceID: f4c99b71-d781-9569-3eb4-a2306cde9a7c

   optInRequired: 3

   splunkVersion: 9.0.0

   timestamp: 1658189286

   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33

   version: 4

   visibility: anonymous,support
app.session.MissionControl.splPreviewError Metadata about errors when making Preview call for SPL queries from the UI.
JSON 
component: app.session.MissionControl.splPreviewError

   data: { [-]
     action: searchResults.error
     app: missioncontrol
     executionTime: 34.39999997615814
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     searchMacro: | `mc_incidents`
     sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b
   }

   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb

   eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c

   experienceID: b26453d2-6630-784f-3624-98360be1e98e

   optInRequired: 3

   splunkVersion: 9.0.0

   timestamp: 1658188621

   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33

   version: 4

   visibility: anonymous,support
app.session.rum.mark How much time does it take to render the AQ table with preview results.
JSON 
{
   app: splunk_instrumentation
   component: app.session.rum.mark
   data: { [-]
     aggregatedTimings: { [-]
       appserver: { [-]
         dns: 0
         load: 0.5
         processing: 3622.399999976158
         redirect: 0
         request: 851.5
         response: 4.199999988079071
         tcp: 0
         totalRequests: 5
       }
       other: { [-]
         dns: 0
         load: 0
         processing: 0
         redirect: 0
         request: 0
         response: 5180.199999988079
         tcp: 0
         totalRequests: 1
       }
       splunkd: { [-]
         dns: 0
         load: 0
         processing: 0
         redirect: 0
         request: 5019.4000000059605
         response: 673.5999999642372
         tcp: 0
         totalRequests: 36
       }
       static-asset: { [-]
         dns: 0
         load: 0
         processing: 0
         redirect: 0
         request: 2214.800000011921
         response: 3604.4999999403954
         tcp: 82.90000000596046
         totalRequests: 19
       }
     }
     app: missioncontrol
     context: { [-]
     }
     firstContentfulPaint: 3259.5999999940395
     firstPaint: 847.9000000059605
     hero: IncidentReview-TimeToInteractive
     navigationTimings: { [-]
       dns: 0
       load: 0.5
       processing: 3622.399999976158
       redirect: 0
       request: 316.40000000596046
       requestType: appserver
       response: 0.7999999821186066
       tcp: 0
     }
     page: mc_incident_review
     sourceLocation: IncidentListFirstResults
     timeSinceOrigin: 5356.299999982119
     transactionId: cdb0a550-a33a-11ed-8089-556e41c09736
   }
   datetime: 02-02-2023 20:53:27.710 +0000
   deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   environment: stg
   eventID: 3EC8DAC5-25CD-49C6-B339-F45F03DF63EA
   executionID: 4429B60C-4B5F-43DB-A035-FFFB58E673BE
   experienceID: 92d8db2e-f7a4-7a59-002f-4e93618d675f
   optInRequired: 3
   stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
   timestamp: 1675370848
   type: event
   userID: c25a863e6f07498b1e1a7e1f5c3d4ebc32669307dcb9138d4852eb5df2b7f4b7
   visibility: anonymous,support

}
mc_get_observable_objects_command.log Logs from the custom search command.
JSON 
{"location": "splunk_search.py:41", "time": "2023-04-23T13:27:49Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Creating search job", "level": "INFO", "metadata": {"sid": "1682256464.16"}}
{"location": "splunk_search.py:51", "time": "2023-04-23T13:27:49Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Search Job: sid=1682256469.19", "level": "INFO", "metadata": {"sid": "1682256464.16"}}
{"location": "splunk_search.py:122", "time": "2023-04-23T13:27:54Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Waiting for search to complete. dispatchState=PARSING", "level": "INFO", "metadata": {"sid": "1682256464.16"}}
{"location": "splunk_search.py:97", "time": "2023-04-23T13:27:54Z", "filename": "splunk_search.py", "hostname": "C02G238WMD6R", "service": null, "message": "Completed running search. Getting results.", "level": "INFO", "metadata": {"sid": "1682256464.16"}}
app.session.MissionControl.responseTemplateCreated Name of the hashed response name and its status.
JSON 
component: app.session.MissionControl.responseTemplateCreated

   data: { [-]
     app: missioncontrol
     name: 7eg860c3247cc8a00e7eb6783bc827be5ffc89e6abd721a6831c8903a9363f25
     status: draft
     page: mc_content
     pathname: /en-US/app/missioncontrol/mc_content
     sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b
   }

   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb

   eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c

   experienceID: b26453d2-6630-784f-3624-98360be1e98e

   optInRequired: 3

   splunkVersion: 9.0.0

   timestamp: 1658188621

   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33

   version: 4

   visibility: anonymous,support
app.session.MissionControl.responseTemplateUpdated Name of the hashed response name and its status.
JSON 
component: app.session.MissionControl.responseTemplateUpdated

   data: { [-]
     app: missioncontrol
     name: 7eg860c3247cc8a00e7eb6783bc827be5ffc89e6abd721a6831c8903a9363f25
     status: draft
     page: mc_content
     pathname: /en-US/app/missioncontrol/mc_content
     sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b
   }

   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb

   eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c

   experienceID: b26453d2-6630-784f-3624-98360be1e98e

   optInRequired: 3

   splunkVersion: 9.0.0

   timestamp: 1658188621

   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33

   version: 4

   visibility: anonymous,support
app.session.MissionControl.responseTemplateAppliedManually Incident id and the number of templates applied.
JSON 
component: app.session.MissionControl.responseTemplateAppliedManually

   data: { [-]
     app: missioncontrol
     incidentId: 7eg860c3247cc8a00e7eb6783bc827be5ffc89e6abd721a6831c8903a9363f25
     count: 3
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b
   }

   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb

   eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c

   experienceID: b26453d2-6630-784f-3624-98360be1e98e

   optInRequired: 3

   splunkVersion: 9.0.0

   timestamp: 1658188621

   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33

   version: 4

   visibility: anonymous,support
app.session.MissionControl.responseTemplateAppliedByType Incident type and the number of templates applied.
JSON 
component: app.session.MissionControl.responseTemplateAppliedByType

   data: { [-]
     app: missioncontrol
     incidentType: test
     count: 5
     page: mc_settings
     pathname: /en-US/app/missioncontrol/mc_settings
     sessionID: b55ed6e3-e92d-4336-b074-54fe5f45987b
   }

   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb

   eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c

   experienceID: b26453d2-6630-784f-3624-98360be1e98e

   optInRequired: 3

   splunkVersion: 9.0.0

   timestamp: 1658188621

   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33

   version: 4

   visibility: anonymous,support
app.session.MissionControl.manualIncidentCreated Incident type.
JSON 
component: app.session.MissionControl.manualIncidentCreated

   data: { [-]
     incident_type: test
   }

   deploymentID: 1402b1ce-9e6a-5ebb-a111-eb238e56c3eb

   eventID: b63f483f-fea3-3e23-b6b3-e7600b01ac9c

   experienceID: b26453d2-6630-784f-3624-98360be1e98e

   optInRequired: 3

   splunkVersion: 9.0.0

   timestamp: 1658188621

   userID: 5db860c6547bb8a00e7eb9668bc827be5ffc77e6abd306a6950c8903a9363f33

   version: 4

   visibility: anonymous,support
app.session.MissionControl.soarProvisioning UI telemetry related to SOAR provisioning and de-provisioning
JSON 
app: splunk_instrumentation
component: app.session.MissionControl.soarProvisioning
data: { [-]
    action: soarTrialInformationModal.open
    app: missioncontrol
    page: mc_incident_review
    pathname: /en-US/app/missioncontrol/mc_incident_review
    sessionID: beb760f5-553e-4e0c-b3c9-e19c79375ac5
}
datetime: 06-28-2023 19:47:12.999 +0000
deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
environment: stg
eventID: CAFA41AA-C7FC-4CA9-9CD6-AF40ED24A007
executionID: 75812D8A-6B93-4598-99E2-9A6ADA5941FE
experienceID: 331dfd32-d8a8-2193-e830-29dcaea81bdf
optInRequired: 3
stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250
timestamp: 1687980731
type: event
userID: 37a44c7717e338af39ec632ac18ae89dc778b7e72f67aa5361f9cea381d570c8
visibility: anonymous,support
app.MissionControl.Event_Add BE telemetry related to artifact extraction. Triggered by an instance of events being added to an incident.
JSON 
{
    "type": "event",
    "component": "app.MissionControl.Event_Add",
    "optInRequired": 3,
    "data": {"artifact_count": 4},
}
app.MissionControl.Event_Create BE telemetry related to artifact extraction. Triggered by an instance of events being created.
JSON 
{
    "type": "event",
    "component": "app.MissionControl.Event_Create",
    "optInRequired": 3,
    "data": {"artifact_count": 4},
}
app.MissionControl.Event_Update BE telemetry related to artifact extraction. Triggered by an event being updated.
JSON 
{
    "type": "event",
    "component": "app.MissionControl.Event_Update",
    "optInRequired": 3,
    "data": {"artifact_count": 4},
}
app.MissionControl.New_Parent_Child_Incident_Relationship BE telemetry related to parent and child incident relationship. Triggered when a parent incident with no current children, adds a child incident or incidents.
JSON 
{ [-]
   app: missioncontrol
   component: app.MissionControl.New_Parent_Child_Incident_Relationship
   data: { [-]
     incident_count: 1
   }
   datetime: 08-15-2023 20:08:24.696 +0000
   deploymentID: CLOUD-31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab
   environment: stg
   eventID: E568971C-202F-4A4C-8F66-68D411101E95
   executionID: 0B01BAC4-5539-4F18-A1A7-3CE29FB84CBC
   optInRequired: 3
   stackID: 31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab
   timestamp: 1692129643
   type: event
   userID: 8465834b65d1f3593d2b885de0b1788074fad108e2db680d0e8fd41b2d765736
   visibility: anonymous,support




}
app.MissionControl.Added_Children_Incidents BE telemetry related to parent and child incident relationship. Triggered when a parent incident adds a child incident or incidents.
JSON 
{ [-]
   app: missioncontrol
   component: app.MissionControl.Added_Children_Incidents
   data: { [-]
     children_incident_count: 6
     incident_count: 1
   }
   datetime: 08-15-2023 20:08:24.696 +0000
   deploymentID: CLOUD-31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab
   environment: stg
   eventID: 12B480DA-079B-43AC-9E8E-AAE2B11B5BBD
   executionID: 0B01BAC4-5539-4F18-A1A7-3CE29FB84CBC
   optInRequired: 3
   stackID: 31fdbb8432b1089489ed46906f0574a4e9e87af758eb485a5c68501b55aab2ab
   timestamp: 1692129643
   type: event
   userID: 8465834b65d1f3593d2b885de0b1788074fad108e2db680d0e8fd41b2d765736
   visibility: anonymous,support




}
app.session.MissionControl.soarProvisioning (updated) UI telemetry related to SOAR provisioning and de-provisioning. Triggered by: opening soar trial info modal, exporting usage report PDF, API or SPL query requests on the modal failing.
JSON 
app: splunk_instrumentation




   component: app.session.MissionControl.soarProvisioning




   data: { [-]
     action: soarTrialInformationModal.apiFailed
     endpoint: fetchTopPlaybook
     statusCode: 401
     err: example_error
     app: missioncontrol
     page: mc_incident_review
     pathname: /en-US/app/missioncontrol/mc_incident_review
     sessionID: beb760f5-553e-4e0c-b3c9-e19c79375ac5
   }




   datetime: 06-28-2023 19:47:12.999 +0000




   deploymentID: CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250




   environment: stg




   eventID: CAFA41AA-C7FC-4CA9-9CD6-AF40ED24A007




   executionID: 75812D8A-6B93-4598-99E2-9A6ADA5941FE




   experienceID: 331dfd32-d8a8-2193-e830-29dcaea81bdf




   optInRequired: 3




   stackID: 5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250




   timestamp: 1687980731




   type: event




   userID: 37a44c7717e338af39ec632ac18ae89dc778b7e72f67aa5361f9cea381d570c8




   visibility: anonymous,support
app.session.MissionControl.riskEventTimelineViewed This UI telemetry collects the risk event data of the incident. The risk event data includes the number of events, type of the events and the total risk score.
JSON 
{
    "component": "app.session.MissionControl.riskEventTimelineViewed",
    "data": {
        "incidentId": "6496f9ad-ce1f-4864-9aa4-8095d7aeb4b1",
        "eventCount": 100,
        "eventType": "user",
        "score": "6512.0",
        "pathname": "/en-US/app/missioncontrol/mc_incident_review",
        "sessionID": "99412f67-4bd1-407f-a6d7-c6e9ca05f8ad",
        "app": "missioncontrol",
        "page": "mc_incident_review"
    },
    "timestamp": 1695664524,
    "visibility": [
        "anonymous",
        "support"
    ],
    "experienceID": "91c0a41e-d8b7-7adb-3058-b587896ba6fa",
    "deploymentID": "CLOUD-b08dc8b01ce7ac7d132b0e2406e4f45bf7134152315d732e5c8537c9f5793e0b",
    "userID": "1b599e8c8a86f88792ecf11be4145a9ef43b623f6451824bd630fadf63014a4b",
    "eventID": "b8e3db7c-7be1-bc3a-4d15-276ebf6ae6a2",
    "splunkVersion": "9.0.2209.4",
    "optInRequired": 3,
    "type": "event"
}
app.session.MissionControl.parentChildDropdownSelected UI telemetry relating to parent and child incident relationships. This is collected when the user selects an option in the parent child dropdown of any section to view parent data, child data, or aggregate data.
JSON 
{
    "component": "app.session.MissionControl.parentChildDropdownSelected",
    "data": {
        "dropdown": "summary",
        "view": "Parent incident",
        "incidentId": "48058722-2460-4ca7-915b-1600a83f416c",
        "pathname": "/en-US/app/missioncontrol/mc_incident_review",
        "sessionID": "f8944054-fb4f-4930-b058-1170953a0390",
        "app": "missioncontrol",
        "page": "mc_incident_review"
    },
    "timestamp": 1696021630,
    "visibility": [
        "anonymous",
        "support"
    ],
    "experienceID": "77c39d6d-ac42-dbf6-0993-162c237aab27",
    "deploymentID": "CLOUD-5e5f17890beb870c68fc5a9be938f3ccdf67e026d3823819e160e62b2423f250",
    "userID": "d2eef8e82a3b6b27ed917529f98f5fae14dbc1591a95aebf3c53c5796d159738",
    "eventID": "6987c0e4-fd29-5f3b-5c7e-ef1f9890e8cb",
    "splunkVersion": "9.0.2303.202",
    "optInRequired": 3,
    "type": "event"
}
app.session.MissionControl.splDelayWarning This UI telemetry keeps track a rare race condition where the return of the incident data by SPL is slower than the one by REST API.
JSON 
{
    "component": "app.session.MissionControl.splDelayWaring",
    "data": {
        "incidentId": "6496f9ad-ce1f-4864-9aa4-8095d7aeb4b1",
        "pathname": "/en-US/app/missioncontrol/mc_incident_review",
        "sessionID": "99412f67-4bd1-407f-a6d7-c6e9ca05f8ad",
        "app": "missioncontrol",
        "page": "mc_incident_review"
    },
    "timestamp": 1695664524,
    "visibility": [
        "anonymous",
        "support"
    ],
    "experienceID": "91c0a41e-d8b7-7adb-3058-b587896ba6fa",
    "deploymentID": "CLOUD-b08dc8b01ce7ac7d132b0e2406e4f45bf7134152315d732e5c8537c9f5793e0b",
    "userID": "1b599e8c8a86f88792ecf11be4145a9ef43b623f6451824bd630fadf63014a4b",
    "eventID": "b8e3db7c-7be1-bc3a-4d15-276ebf6ae6a2",
    "splunkVersion": "9.0.2209.4",
    "optInRequired": 3,
    "type": "event"
}