User and entity behavior analytics (UEBA) overview in Splunk Enterprise Security

User and Entity Behavior Analytics (UEBA) identifies anomalies by comparing current activity against learned baselines for users and assets. It helps analysts detect insider threats, reduce false positives, and prioritize investigations based on risk.

UEBA collects and correlates data features from multiple sources, such as authentication logs, endpoints, and network traffic, to:

  • Extract behavioral features, such as login frequency or data access volume
  • Baseline normal activity for each user or entity
  • Measure deviations from those baselines
  • Assign entity risk scores that indicate potential threats

With UEBA, you can detect suspicious behavior early, focus on high-risk anomalies rather than isolated alerts, and maintain compliance and investigation visibility. By modeling normal behavior and scoring deviations, UEBA helps you detect threats faster and more precisely across users and entities.

User and entity behavior analytics (UEBA) apps

The following UEBA-related are apps available:

App name Deployment type Description
DA-ESS-UEBA Both

Available by default in Splunk Enterprise Security Premier Edition for both cloud and on-premises deployments. No installation required to access UEBA dashboards and other capabilities.

Note: There are a number of entity risk scoring searches used broadly by Enterprise Security that are also located in this app.

UEBA Content App for On-premises

(DA-ESS-UEBAContent)

 On-premises

Install on on-premises deployments to extend the functions of UEBA and access UEBA detections.

Includes all detections listed in UEBA detection reference for UEBA on-premises .

UEBA Content App for Cloud

(DA-ESS-UEBASecurityContent)

 Cloud

Available by default in Splunk Enterprise Security Premier Edition cloud deployments to extend the functions of UEBA and access UEBA detections.

supports the following cloud app detections, listed in UEBA detection reference for UEBA cloud:

  • Unusual Volume of Data Downloaded per User

  • Unusual Volume Of Data Uploaded Per User By Business Unit​

The capabilities of this app do not duplicate those of the on-premises app.

Accessing UEBA in Splunk Enterprise Security

There is no manual pairing or installation process required to access UEBA in either cloud or on-premises deployments of Splunk Enterprise Security (ES). If your organization has Splunk Enterprise Security Premier Edition, then UEBA features, such as new dashboards and analytics, are automatically activated. You can start using UEBA features in your environment.

For support, reach out to your account management team.

For more UEBA detection content, you can install the UEBA Content App for On-premises (DA-ESS-UEBAContent) or UEBA Content App for Cloud (DA-ESS-UEBASecurityContent). Refer to the documentation that corresponds to your deployment type:

Note: If you customized your navigation bar in earlier versions of Splunk Enterprise Security, reset it after upgrading to version 8.x to see the UEBA dashboards. This reset is only required once. See Customize the menu bar in Splunk Enterprise Security.

Example: Alex, Detection Engineer

Alex uses UEBA to understand which entities and assets in their environment are exhibiting behavior that is abnormal compared to their traditional baseline. Alex can visualize deviations from normal behavior and drill down to the underlying raw logs to verify. The detections automatically tune by:

  • Adjusting thresholds for UEBA detections to reduce false positives
  • Applying macros and suppression logic to exclude known safe behavior
  • Refining detection logic and risk scoring so that findings contributing to the Entity Risk Score (ERS) more accurately reflect true risk

They can also manage Finding exclusions to remove intermediate findings from a specific detection for a set time range or indefinitely, so that detection results are tailored to their environment.

Alex and other analysts can use Entity lists to focus dashboard results on specific assets or identities, or filter them out to concentrate on other entities. These lists enhance investigation efficiency by narrowing the behavioral context.