Edit or delete custom models

You can edit or delete custom models in Splunk UBA.

Note: The logged-in user must have the role of Content_Developer to edit or delete custom models.

Edit a custom model

Edit an existing custom model by performing the following tasks:

  1. In Splunk UBA, select System > Models.
  2. Click Custom Models.
  3. Hover over the name of the model you want to edit, click the hamburger (The edit model icon) icon and select Edit.
  4. Navigate through the Edit Custom Model wizard and make the desired changes. The screen are the same as the ones described in Create a new custom model.
  5. Click OK.
CAUTION: Editing an active model makes it inactive, even if you do not make any changes. You can trigger or re-activate the model as needed.

Delete a custom model

Delete an existing custom model by performing the following tasks:

  1. In Splunk UBA, select System > Models.
  2. Click Custom Models.
  3. Hover over the name of the model you want to edit, click the hamburger (The edit model icon) icon and select Delete.
  4. Click OK to confirm that you want to delete this model.

When a custom model is deleted from the system, the following content is also deleted:

  • All anomalies raised by the model regardless of their status as active or in test mode
  • All threats generated by the anomalies raised by the model