UEBA Content App for Cloud
The UEBA Content App for Cloud (DA-ESS-UEBASecurityContent) is a configuration-only Splunk application that collects security event data from your environment, transforms it into UEBA-supported formats, and forwards it to UEBA Cloud for behavioral analytics and threat detection.
This app is available only for cloud deployments and is available by default when you install or upgrade your Splunk Enterprise Security cloud deployment.
Prerequisites
The following items are required to use the UEBA Content App for Cloud (DA-ESS-UEBASecurityContent) with Splunk Enterprise Security.
| Requirement | Details |
|---|---|
| CIM | Common Information Model add-on installed and configured |
| Data models | Network_Traffic datamodel accelerated (required for UEBA Dataset) |
| UEBA Cloud | Active UEBA Cloud subscription and connectivity |
| Historical data | Minimum 7 days required for anomaly detections to produce findings |