Verification and setup for the UEBA Content App

how to verify your content app was set up correctly from your Enterprise Security install or upgrade

Follow these steps to verify that you are ready to use the UEBA Content app for Cloud (DA-ESS-UEBASecurityContent).

Step 1: Verify installation

  1. In Splunk Web, navigate to Apps > Manage Apps.

  2. Locate the UEBA Content App for Cloud (DA-ESS-UEBASecurityContent) in the app list and confirm it is installed.

Step 2: Verify your transformation

Validate and enable your transformations, following the steps in Manage UEBA datasets.

Step 3: Enable the detections

Enable detections in Enterprise Security:

  1. Navigate to Enterprise Security > Content Management .

  2. Enable the detections.

For detection descriptions, tuning guidance, MITRE mappings, corresponding UEBA Dataset and risk scores,, see UEBA detection reference for UEBA cloud.