Troubleshooting the UEBA Content App for Cloud

Solutions to common issues with the UEBA Content App for Cloud

Scheduled search is not running

Symptom: Search execution history shows no recent runs.

Resolution:

  1. Verify the search is enabled:
    1. Navigate to Settings > Searches, reports, and alerts.
    2. Confirm the search is enabled.
  2. Check the scheduler log:
    CODE 
    index=_internal source=*scheduler.log*
  savedsearch_name="UEBA - Network Traffic Volume Summarization - Summary Gen"
| table _time, savedsearch_name, status, message

Network Traffic Volume Summarization is running but producing no results

Symptoms: The search executes successfully but returns 0 events. Detections produce no findings.

Resolution:

  1. Verify that your Network_Traffic data model is accelerated and populated:
    1. Navigate to Settings > Data models, then locate Network_Traffic.
    2. Confirm that acceleration is enabled and that the summaries are up-to-date.
  2. Run the mapping macro directly to check whether CIM fields are present:
    CODE 
    | `ueba_udd_map_network_traffic("*")`
| stats count

    If the count is 0, the Network_Traffic data model has no data. Verify that your network sourcetype values are correctly mapped to the CIM Network_Traffic data model. Refer to Network Activity Dataset.

  3. Confirm that traffic events include user identity information. Events without a user will not produce per-user anomaly findings:
    CODE 
    | `ueba_udd_map_network_traffic("*")`
| stats count, count(eval(isnotnull(actor__user__name))) as with_user

Detections are enabled but producing no anomaly findings

Symptom: Network traffic data is flowing but no risk events appear in Enterprise Security.

Resolution:

  1. Confirm that the UEBA - Network Traffic Volume Summarization - Summary Gen saved search is enabled and running successfully.
  2. Confirm that both relevant detections are enabled in Enterprise Security > Content Management.
  3. Verify that at least 7 days of network traffic data has been collected. The anomaly models require a minimum historical baseline before reporting findings.
  4. Check that your network traffic events include user identity fields. Run the following search and confirm that with_user is non-zero:
    CODE 
    | `ueba_udd_map_network_traffic("*")`
| stats count, count(eval(isnotnull(actor__user__name))) as with_user

Macro changes not taking effect

Symptom: Changes to a normalization macro don't appear in search results.

Resolution:

  1. Verify that the macro is defined in the correct app context (UEBA Content) and that your role permissions allow searches to access it.

    Navigate to Settings > Advanced search > Search macros.

  2. Test the macro directly in the search field to confirm that it returns events:
    CODE 
    | `ueba_udd_map_network_traffic("*")`
| table actor__user__name, src_endpoint__ip, traffic__bytes_in, traffic__bytes_out
| head 10