Components and cautions for UEBA Content App

Saved searches, macros, and cautions for the UEBA Content App

The UEBA Content App for Cloud includes the following components:

For cautions and instructions, refer to Cautions and restrictions

Saved searches

The UEBA Content App for Cloud includes the following saved search:

UEBA - Network Traffic Volume Summarization - Summary Gen (UEBA dataset)

Purpose: Aggregates network traffic events from the CIM Network_Traffic data model, normalizes them to UEBA dataset format, and forwards them to UEBA Cloud as input for anomaly detections. For information on the data model, see Field mapping for UEBA Content App for Cloud .

Data source required: CIM Network_Traffic.All_Traffic data model (accelerated)

Schedule and search configuration:

Setting Value
Frequency Every 15 minutes (should not be modified)
Search time range (earliest) -24h
Search time range (latest) now
Index-time dispatch earliest

-15m

With Index-time dispatch latest, controls which events are scanned per run.
Index-time dispatch latest

now

With Index-time dispatch earliest, controls which events are scanned per run.
Allow skew

100%

Allow skew of 100% means Splunk may delay execution up to one full interval (15 minutes) to balance scheduler load.
Max event count 1,000,000

Macros

The UEBA Content App for Cloud includes the following macro:

ueba_udd_map_network_traffic

Used by: UEBA - Network Traffic Volume Summarization - Summary Gen See the previous section, Saved searches.

Purpose: Maps CIM Network_Traffic datamodel fields to UEBA Dataset field names. To validate field coverage during setup, see Step 2: Verify the mapping macro produces results later in this chapter.

Cautions and restrictions

Although the normalization macros are editable, incorrect changes can break data forwarding to Splunk UEBA Cloud.

CAUTION: Do not modify the app's saved search SPL directly on Splunk Cloud.

Do not modify the normalization macros listed in this table:

Do not modify these configurations Reason Impact
Field data types in SPL toint(), tostring() etc. are required for schema compliance Changing data types will break schema validation in UEBA Cloud
UEBA Dataset fields Fields like connection_info__direction, traffic__bytes_in, actor__user__name are required Missing required fields will cause events to be silently dropped
User and device entity fields UEBA Cloud requires at least one valid user or device entity per event Removing actor__user__name or device fields will cause every event to be dropped
Macro names Referenced directly by the saved searches Renaming macros will break all scheduled searches

Additional restrictions

  • Do not remove required or recommended fields from the normalization macros.

  • Do not modify json_object() calls without understanding the UEBA Dataset. For the full list of mappings, refer to Field mapping for UEBA Content App for Cloud .

  • Do not eave the fieldsummary block active after testing. It replaces per-event rows with summary rows and breaks json_object | collect.

Consequences of invalid changes:

  • Events might be silently dropped by UEBA Cloud with no error surfaced in Splunk.

  • Downstream anomaly detections might not produce findings.

  • Historical data might become incompatible with new data.