Share Splunk Mission Control data usage in Splunk Enterprise Security
How data is collected
Splunk Mission Control uses saved searches to collect anonymous usage data. These searches run in the background regardless of whether or not you opt-in to send usage data to Splunk, and do not have any significant impact on performance.
What data is collected
Splunk Mission Control collects the following basic usage information:
| Name | Description | Example |
|---|---|---|
app.MissionControl.active_users
|
Count of unique users accessing any views in the app. |
|
app.MissionControl.configuration
|
General configuration states of the app. |
|
app.MissionControl.incidents
|
Count of incidents created in the last 24 hours and metadata about them. |
|
app.MissionControl.responseplans
|
Statistics about the count of response plans per incident. |
|
app.MissionControl.responseplanstasks
|
Statistics about the count of tasks per response plan. |
|
app.session.MissionControl.splSuccess
|
Metadata about successful SPL queries triggered by the UI to power features in the app. |
|
app.session.MissionControl.splError
|
Metadata about errors when making SPL queries from the UI. |
|
app.session.MissionControl.pageView
|
UI user access to sub-routes within the app. |
|
app.session.MissionControl.uiError
|
Any errors caught by the UI JavaScript code. |
|
app.session.MissionControl.searchChange
|
Tracking how users are using the custom search feature on the Incident Review page. |
|
app.session.MissionControl.dateTimeFilterChange
|
Tracking how users are using the data-range picker in the Incident Review page. |
|
app.session.MissionControl.previewClick
|
Tracking how users are using the Preview feature in Incident Review. |
|
app.session.MissionControl.sortClick
|
Tracking how users are sorting the table of Incidents in Incident Review. |
|
app.session.MissionControl.responsePlanTaskEnded
|
Tracking whenever response plan tasks are completed by a user. |
|
app.MissionControl.CustomField_Create
|
Count of custom fields created. |
|
app.MissionControl.Event_List
|
Statistics about the amount and duration of searches when listing events. |
|
app.session.rum.mark
|
UI performance metrics. |
|
app.session.rum.measure
|
UI performance metrics. |
|
app.session.MissionControl.responsePlanSoarAutomationClicked
|
Type of automation executed in response plan. |
|
app.MissionControl.Create_Event
|
Count of events created. |
|
app.MissionControl.Delete_Event
|
Count of events deleted. |
|
app.MissionControl.fileUploadedIncident
|
File name and size. |
|
app.MissionControl.fileUploadedTask
|
File name and size. |
|
app.MissionControl.fileDownloaded
|
File name and size. |
|
app.session.MissionControl.splPreviewSuccess
|
Metadata about successful SPL Preview results triggered by the UI to power features in the app. |
|
app.session.MissionControl.splPreviewError
|
Metadata about errors when making Preview call for SPL queries from the UI. |
|
app.session.rum.mark
|
How much time does it take to render the AQ table with preview results. |
|
mc_get_observable_objects_command.log
|
Logs from the custom search command. |
|
app.session.MissionControl.responseTemplateCreated
|
Name of the hashed response name and its status. |
|
app.session.MissionControl.responseTemplateUpdated
|
Name of the hashed response name and its status. |
|
app.session.MissionControl.responseTemplateAppliedManually
|
Incident id and the number of templates applied. |
|
app.session.MissionControl.responseTemplateAppliedByType
|
Incident type and the number of templates applied. |
|
app.session.MissionControl.manualIncidentCreated
|
Incident type. |
|
app.session.MissionControl.soarProvisioning
|
UI telemetry related to SOAR provisioning and de-provisioning |
|
app.MissionControl.Event_Add
|
BE telemetry related to artifact extraction. Triggered by an instance of events being added to an incident. |
|
app.MissionControl.Event_Create
|
BE telemetry related to artifact extraction. Triggered by an instance of events being created. |
|
app.MissionControl.Event_Update
|
BE telemetry related to artifact extraction. Triggered by an event being updated. |
|
app.MissionControl.New_Parent_Child_Incident_Relationship
|
BE telemetry related to parent and child incident relationship. Triggered when a parent incident with no current children, adds a child incident or incidents. |
|
app.MissionControl.Added_Children_Incidents
|
BE telemetry related to parent and child incident relationship. Triggered when a parent incident adds a child incident or incidents. |
|
app.session.MissionControl.soarProvisioning (updated) |
UI telemetry related to SOAR provisioning and de-provisioning. Triggered by: opening soar trial info modal, exporting usage report PDF, API or SPL query requests on the modal failing. |
|
app.session.MissionControl.riskEventTimelineViewed
|
This UI telemetry collects the risk event data of the incident. The risk event data includes the number of events, type of the events and the total risk score. |
|
app.session.MissionControl.parentChildDropdownSelected
|
UI telemetry relating to parent and child incident relationships. This is collected when the user selects an option in the parent child dropdown of any section to view parent data, child data, or aggregate data. |
|
app.session.MissionControl.splDelayWarning
|
This UI telemetry keeps track a rare race condition where the return of the incident data by SPL is slower than the one by REST API. |
|