The MITRE ATT&CK framework provides guidance across four key cybersecurity use cases:
threat intelligence, detection and analytics, adversary emulation and red teaming, and assessment and engineering. It is designed to help organizations understand and defend against real-world adversary behaviors.

In Splunk Enterprise Security, the Network Security Domain houses dashboards that surface vulnerability information derived from network-level devices and scanners (including vulnerability scanners, next-generation firewalls, IDS/IPS, and other network security appliances).

Workflow actions let you click on a field value, like an IP address, in search results or dashboards and invoke external lookups or queries (for example, sending the IP to a threat-intel service) directly from the Splunk UI.

"Impossible travel" detections fall under Identity Anomalies in Splunk ES, as they flag unusual or impossible user authentication behavior tied to a specific identity.