Installing the UEBA Content App for On-premises

Note: If you are upgrading from a previous version, see Upgrading to Enterprise Security and the UEBA Content App version 8.8.0.

For prerequisites, see UEBA Content App for On-premises.

To install the UEBA Content App for On-premises deployments (DA-ESS-UEBAContent), follow these steps:

  1. Go to Splunkbase and log in with your Splunk.com ID. You must be a licensed user to download the product.
  2. Download the UEBA Content App for On-premises (DA-ESS-UEBAContent) from Splunkbase.
  3. Choose Download, and save the app file to your desktop.
  4. Log in to the search head as an administrator.
    Note: Install the UEBA Content App for On-premises on the same search head as Splunk Enterprise Security.
  5. On the Splunk Enterprise search page, select Apps > Manage Apps and select Install App from File.
  6. Select Choose File and go to the UEBA product file.
  7. Select Upload to install.

For instructions on installing the UEBA Content App for On-premises in a search head cluster environment and for configuring the ueba_summaries index in an index cluster, see Install Splunk Enterprise Security in a search head cluster environment and Configure and deploy indexes for Splunk Enterprise Security.

Upgrading to Enterprise Security and the UEBA Content App version 8.8.0

If you have already installed Splunk Enterprise Security and the UEBA Content App, upgrade to version 8.8.0 in the following order.

The order of upgrade steps is important. There is no automatic correction for upgrades made in a different order.

  1. Upgrade Splunk Enterprise Security to 8.8.0 first.

  2. Upgrade the UEBA Content App (DA-ESS-UEBAContent) to 8.8.0.

  3. Recommended. Optionally turn off the existing Summarization Searches and use the UEBA Pipeline Management page to turn on the UEBA Detection Dataset Summarization Searches for your environment.

    Note: Do not run them both at the same time, because this will duplicate input data to the searches and cause inaccurate Findings.

After a successful upgrade, performed in the correct order, you will see the following:

  • Your existing Summarization Search: preserved, still running; no further action required

  • Enabled/disabled state of your UEBA Detection: preserved; no further action required

  • Some contributing event search behavior has changed for some detections. For example, authentication now supports both UDD and CIM field shapes and time windows are explicit and can be narrower than the daily detection window.

Saved searches

Starting with release 8.8.0, some saved searches names have been updated to correct naming inaccuracies from previous releases.

Name in ES 8.7 (UEBA 1.3.0) Name in ES 8.8 (UEBA 8.8) Notes
UEBA - Brute Force Authentication Per User Feature Count - Summary Gen UEBA - Brute Force Authentication per User Feature Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per User Feature Type - Summary Gen UEBA - Brute Force Authentication per User Feature Type - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per User Feature Vol Count - Summary Gen UEBA - Brute Force Authentication per User Feature Vol Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per User Feature Vol Type - Summary Gen UEBA - Brute Force Authentication per User Feature Vol Type - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per Device Feature Count - Summary Gen UEBA - Brute Force Authentication per Device Feature Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per Device Feature Vol Count - Summary Gen UEBA - Brute Force Authentication per Device Feature Vol Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Unusual Network Traffic Volume Per User Feature Download - Summary Gen UEBA - Network Traffic Volume per User Feature Download - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Upload - Summary Gen UEBA - Network Traffic Volume per User Feature Upload - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Download - Summary Gen UEBA - Network Traffic Volume per Device Feature Download - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Upload - Summary Gen UEBA - Network Traffic Volume per Device Feature Upload - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Outgoing Connections - Summary Gen UEBA - Network Traffic Volume per Device Feature Outgoing Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Upload DMZ Devices - Summary Gen UEBA - Network Traffic Volume per User Feature Upload To DMZ Devices - Feature Gen The producer is represented as a feature, and the name identifies uploads to DMZ devices more explicitly.
UEBA - Unusual Network Traffic Volume Per Device Feature Blocked Connections - Summary Gen UEBA - Network Traffic Volume per Device Feature Blocked Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Blocked Connections - Summary Gen UEBA - Network Traffic Volume per User Feature Blocked Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Bytes - Summary Gen UEBA - Network Traffic Volume per Device Feature Bytes - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Download Internal Server - Summary Gen UEBA - Network Traffic Internal Server per User Feature Download - Feature Gen The producer is represented as a feature, and the name identifies the internal-server scope more directly.
UEBA - Unusual Network Traffic Volume Per User Feature Outgoing Connections - Summary Gen UEBA - Network Traffic Volume per User Feature Outgoing Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Device Feature Data Transmitted - Summary Gen UEBA - Printer Volume per Device Feature Data Transmitted - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Device Feature Print - Summary Gen UEBA - Printer Volume per Device Feature Print - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Device Feature Time - Summary Gen UEBA - Printer Volume per Device Feature Time - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Printer Feature Data Transmitted - Summary Gen UEBA - Printer Volume per Printer Feature Data Transmitted - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Printer Feature Print - Summary Gen UEBA - Printer Volume per Printer Feature Print - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Printer Feature Time - Summary Gen UEBA - Printer Volume per Printer Feature Time - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per User Feature Data Transmitted - Summary Gen UEBA - Printer Volume per User Feature Data Transmitted - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per User Feature Print - Summary Gen UEBA - Printer Volume per User Feature Print - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per User Feature Time - Summary Gen UEBA - Printer Volume per User Feature Time - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB Bytes Read Feature - Summary Gen UEBA - USB Volume Bytes Read Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB Bytes Write Feature - Summary Gen UEBA - USB Volume Bytes Write Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB Denies Feature - Summary Gen UEBA - USB Volume Denies Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB File Operations Feature - Summary Gen UEBA - USB Volume File Operations Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Login Authentication Per User Feature Login - Summary Gen UEBA - Login Authentication per User Feature Login - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Login Authentication Per User Feature Unlock - Summary Gen UEBA - Login Authentication per User Feature Unlock - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Summarization - Summary Gen UEBA - Network Traffic Volume Summarization - Summary Gen The UDD-named counterpart removes Unusual because this summarization does not identify anomalous activity. The legacy search also remains in ES 8.8.
UEBA - Unusual Network Traffic Volume Per User Consolidation - Summary Gen UEBA - Network Traffic Volume per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Network Traffic Volume per Device Consolidation - Summary Gen UEBA - Network Traffic Volume per Device Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Printer Volume per Device Consolidation - Summary Gen UEBA - Printer Volume per Device Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Printer Volume per Printer Consolidation - Summary Gen UEBA - Printer Volume per Printer Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Printer Volume per User Consolidation - Summary Gen UEBA - Printer Volume per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Volume USB Per User Consolidation - Summary Gen UEBA - USB Volume per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Login Authentication Device Lookup - Feature Gen UEBA - Login Authentication Device Lookup - Feature Gen The prefix is removed because this saved search only builds a user-to-device mapping. It does not identify unusual activity.
UEBA - Unusual Login Authentication Per User Consolidation - Summary Gen UEBA - Login Authentication per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares authentication data rather than identifying unusual activity.
UEBA - Unusual Network Traffic Volume Device Lookup - Feature Gen UEBA - Network Traffic Volume Device Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Network Traffic Volume User Lookup - Feature Gen UEBA - Network Traffic Volume User Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Printer Volume Device Lookup - Feature Gen UEBA - Printer Volume Device Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Printer Volume User Lookup - Feature Gen UEBA - Printer Volume User Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Volume USB Device Lookup - Feature Gen UEBA - USB Volume Device Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Volume Of Blocked Connections Per User Scoring - Scoring UEBA - Unusual Volume of Blocked Connections per User Scoring - Scoring The saved-search stanza uses the new release name. Its scoring role remains unchanged.
UEBA - Unusual Volume Of Outgoing Connections Per User Scoring - Scoring UEBA - Unusual Volume of Outgoing Connections per User Scoring - Scoring The saved-search stanza uses the new release name. Its scoring role remains unchanged.
UEBA - Unusual Volume of Data Transmitted to Printer per Device_scoring - Scoring UEBA - Unusual Volume of Data Transmitted to Printer per Device Scoring - Scoring The malformed scoring-name form is replaced with the standard scoring-name form.
UEBA - Unusual Volume of Print per Device scoring - Scoring UEBA - Unusual Volume of Print per Device Scoring - Scoring The saved-search stanza uses the standard scoring-name form.

Search Macros

Several macros are renamed to add prefix them with the ueba_ namespace.

Name in ES 8.7 (UEBA 1.3.0) Name in ES 8.8 (UEBA 8.8)
security_content_ctime(1) ueba_security_content_ctime(1)
security_content_summariesonly ueba_security_content_summariesonly

The following macros have a duplicate counterpart in ES 8.8 to support the UEBA Detection Dataset (UDD) format. ES 8.8 contains both versions of the macros.

Name in ES 8.7 (UEBA 1.3.0) Name in ES 8.8 (UEBA 8.8) Notes
unusual_network_traffic_volume_data_map(1) ueba_udd_map_network_traffic(1) The new macro is the public UDD mapping entry point and delegates to ueba_udd_cim_map_network_traffic(1). The legacy macro remains in ES 8.8.
unusual_login_authentication_data_map ueba_udd_cim_map_authentication(1) and ueba_udd_normalize_authentication The new search path separates CIM-to-UDD mapping from login-authentication normalization. This is not a one-to-one rename, and the legacy macro remains.
ueba_ad_auth_data_map ueba_udd_cim_map_authentication(1) and ueba_udd_normalize_ad_authentication The new search path uses the shared authentication mapper followed by AD-specific normalization. This is not a one-to-one rename, and the legacy macro remains.
unusual_printer_volume_data_map ueba_udd_map_printer_activity(1) The new macro maps printer events into UDD fields. The legacy macro remains in ES 8.8.
unusual_usb_volume_data_map ueba_udd_cim_map_usb_activity(1) The new macro maps USB activity into UDD fields. The legacy macro remains in ES 8.8.
unusual_network_traffic_volume_contributing_events(1) unusual_network_traffic_volume_contributing_events_udd(1) The new macro retrieves contributing events using UDD fields. The legacy contributing-events macro remains in ES 8.8.

Transforms

The following transforms are renamed to add prefix them with the ueba_ namespace.

Name in ES 8.7 (UEBA 1.3.0) Name in ES 8.8 (UEBA 8.8)
cloud_storage_sites_lookup ueba_cloud_storage_sites_lookup
http_unusual_job_search_activity ueba_http_unusual_job_search_activity
http_unusual_traffic_to_anonymizing_sites ueba_http_unusual_traffic_to_anonymizing_sites

Knowledge objects

Starting with release 8.8.0, some knowledge objects have new names. For details, see Knowledge objects for UEBA .