Manage UEBA entity lists

View, modify, or delete UEBA entity lists in your dashboards.
  1. In Splunk Enterprise Security, select Configure then All configurations.
  2. In the UEBA section, select Entity lists.
  3. View all existing UEBA entity lists.
    For each entity list, you can find configuration values, audit fields, and the number of entities currently matching its criteria.
  4. To modify an existing entity list, select the pencil icon under the Actions column.
    Note: You can't change the entity list name.
  5. To delete an entity list, select the trash icon ( ) in the Actions column. Deleting a list does not affect the underlying Assets & Identities Framework data.