Manage UEBA datasets

how to configure UEBA datasets to use your data from other sources

Configure UEBA datasets

A UEBA Dataset is the Splunk UEBA implementation of an event schema for detections that is compatible with OCSF (Open Cybersecurity Schema Framework). Each dataset leverages OCSF objects, attributes, and semantic definitions as Splunk-extracted fields so security telemetry can be normalized and processed by UEBA.
Note: Managing UEBA datasets pertains to both UEBA on both cloud and on-premises. Where there are differences between deployment types, those differences are noted.

Transform your data from CIM (Common Information Model) or custom indexes to normalize it, so it can power UEBA detections.

Note: You must perform this configuration process before your data is usable for UEBA detections.

Splunk provides several UEBA transformations that you can use as is or clone and modify them to suit your needs. These Splunk-provided transformations are inactive until you choose to make them active. You cannot alter or delete these Splunk-provided transformations, but you can clone them, then edit them for your data.

Provided transformations include:

  • Authentication

  • Base badge (On-premises only)

  • Base printer

  • Base USB

  • Email activity (Cloud only)

  • File hosting activity (On-premises only)

  • Network activity (Cloud only)

  • Process activity (Cloud only)

Each of these provided transformations has a corresponding SPL search associated with it. To view the SPL, open any transformation. At the bottom of that page, select Open in Splunk Search.

To view the saved search associated with transformations, refer to Saved searches for transformations, later in this article.

To manage the UEBA datasets and transformations, follow these steps:

  1. From the Configure tab, select UEBA, then UEBA dataset management.

  2. (Conditional) To use a provided transformation, choose which of the provided transformations is closest to your needs. Select the transformation name to see its details. In the Field mapping & validation section, note the required and optional fields for this transformation. Mark the transformation as Active and it's ready to use; you have completed this process.

  3. (Conditional) To customize a provided transformation, locate the provided transformation closest to your needs and select the corresponding Clone button.

  4. Provide a unique name for the clone. You cannot overwrite the transformations provided by Splunk.

  5. In the clone, take note of the required and optional fields for this transformation. Make sure you are using those fields.

  6. Update the code to properly map and transform your data.

  7. After you have updated the code, select Validate to check that it works. If you receive errors, update the code, then select Re-validate.

  8. When you have finished, save the transformation as a draft or activate it for immediate use.

  9. Make sure to enable the relevant detection. In Enterprise Security, select Content Management to find the detection.

To change the schedule, see Saved searches for transformations, later in this article.

You can edit, delete, and view the SPL search for transformations you create.

After you have configured and activated at least one transformation you can review the health metrics at the top of the UEBA dataset management page. You must have at least one active transformation to view the Overall health and Issues detected metrics.

Avoid overlapping mappings and duplicating events

Avoid overlapping mappings across transformations for the same UEBA dataset. When multiple active transformations map data from overlapping sources into the same UEBA dataset, the combined output will contain duplicate events. Only run multiple transformations for the same UEBA dataset when they pull data from entirely different, non-overlapping sources.

Saved searches for transformations

When a transformation is activated, the UEBA Dataset Management page creates a corresponding scheduled saved search that runs every 15 minutes. These saved searches are managed automatically; you do not need to create or configure them manually. This procedure is not a required.

CAUTION: Do not modify the SPL of these saved searches directly. The mapping SPL is managed through the UEBA Dataset Management page. Editing it outside of that page can result in configuration inconsistencies and duplicate detection data. To update a transformation's mapping SPL, use the Edit or Clone actions in the UEBA Dataset Management page.

  1. To locate the saved searches associated with your active transformations:

  2. From the Enterprise Security Settings icon, select Searches, reports, and alerts.

  3. In the Search field, select the appropriate app, depending on your deployment:

    • On-premises: User and Entity Behavioral Analytics Content (DA-ESS-UEBAContent)

    • Cloud: User and Entity Behavioral Analytics Content (DA-ESS-UEBASecurityContent)

  4. Set the Owner filter to All.

  5. Search for UEBA Pipeline -.

To update the schedule for a transformation, follow these additional steps:

  1. Locate the transformation to update. In its associated Actions column, select Edit > Edit schedule. You can only update reports that are active.

  2. Update the Cron expression and select Save.

    Default update value is every 15 minutes.