Verification and setup for the UEBA Content App

how to verify your content app was set up correctly from your Enterprise Security install or upgrade

Follow these steps to verify that you are ready to use the UEBA Content app for Cloud (DA-ESS-UEBASecurityContent).

Step 1: Verify installation

  1. In Splunk Web, navigate to Apps > Manage Apps.

  2. Locate the UEBA Content App for Cloud (DA-ESS-UEBASecurityContent) in the app list and confirm it is installed.

Step 2: Verify the mapping macro produces results

Before enabling the scheduled searches, verify that the macros are extracting fields correctly from your data.

The ueba_udd_map_network_traffic macro has a fieldsummary command embedded as commented SPL.

To verify this macro, follow these steps.

  1. Navigate to Settings > Advanced search > Search macros.
  2. In the App field, select User and Entity Behavioral Analytics Content.
  3. In the macro list, select ueba_udd_map_network_traffic.
  4. In the detail view, copy the macro code.

  5. Open a Search and paste the macro directly in the search field.

  6. Remove the backticks (') surrounding the | fieldsummary block.

    Make the following two additional edits before you run the macro:

    • Add a pipe character (|) to the front of the first line.
    • Remove the | search $first_filter$ line.
  7. Run the macro in Search to validate field coverage.

    To understand which CIM fields map to which UEBA Dataset fields, refer to Field mapping for UEBA Content App for Cloud .

Note: Do not edit the macro itself to make fieldsummary active. Doing so will break the scheduled search; it replaces per-event rows with summary rows and prevents json_object | collect from working correctly.

Step 3: Enable network traffic volume summarization

  1. Navigate to Settings > Searches, reports, and alerts.

  2. In the App field, select User and Entity Behavioral Analytics Content.

  3. Find UEBA - Network Traffic Volume Summarization - Summary Gen and select Edit > Enable.

Note: Enable this search together with the detections in Step 4. Enabling it without enabling the detections will forward data to UEBA Cloud, but will not produce any anomaly findings in Splunk.

Step 4: Enable the detections

Enable the two Unusual Volume of Data detections in Enterprise Security:

  1. Navigate to Enterprise Security > Content Management .

  2. Enable the following two detections

    • Unusual Volume of Data Downloaded per User

    • Unusual Volume Of Data Uploaded Per User By Business Unit

For detection descriptions, tuning guidance, MITRE mappings, and risk scores, see UEBA detection reference for UEBA cloud.

Step 5: Verify search execution

After completing steps 3 and 4, verify that the searches are running. It might take up to 15 minutes for the first search execution.

Navigate to Settings > Searches, reports, and alerts.

Select UEBA - Network Traffic Volume Summarization - Summary Gen to view execution history.

Confirm that a recent successful run appears.

Step 6: Monitor scheduled search performance

  1. Navigate to Settings > Searches, reports, and alerts.

  2. Select the scheduled search name to view execution history.

  3. Review Job > Inspect Job details for errors or warnings.

  4. Check the scheduler log:

CODE 
index=_internal source=*scheduler.log*
  savedsearch_name="UEBA - Network Traffic Volume Summarization - Summary Gen"
| table _time, savedsearch_name, status, message