Components and cautions for UEBA Content App

Saved searches, macros, and cautions for the UEBA Content App

The UEBA Content App for Cloud includes the following components:

For cautions and instructions, refer to Cautions and restrictions

Saved searches

The UEBA Content App for Cloud includes the following saved searches:

UEBA - Network Traffic Volume Summarization - Summary Gen (UEBA dataset)

Purpose: Aggregates network traffic events from the CIM Network_Traffic data model, normalizes them to UEBA dataset format, and forwards them to UEBA Cloud as input for anomaly detections. For information on the data model, see Field mapping for UEBA Content App for Cloud .

Data source required: CIM Network_Traffic.All_Traffic data model (accelerated)

Schedule and search configuration:

Setting Value
Frequency Every 15 minutes (should not be modified)
Search time range (earliest) -24h
Search time range (latest) now
Index-time dispatch earliest

-15m

With Index-time dispatch latest, controls which events are scanned per run.
Index-time dispatch latest

now

With Index-time dispatch earliest, controls which events are scanned per run.
Allow skew

100%

Allow skew of 100% means Splunk may delay execution up to one full interval (15 minutes) to balance scheduler load.
Max event count 1,000,000

UEBA - OCSF Email Activity - Translation

Background: Microsoft retired the legacy o365:reporting:messagetrace sourcetype starting April 6, 2026, replacing it with o365:graph:messagetrace based on the Microsoft Graph API. This search supports ingestion of o365:graph:messagetrace events into UEBA Cloud for email-based anomaly detections.

Purpose: Reads Microsoft 365 message trace events from the o365:graph:messagetrace sourcetype, normalizes them, and forwards them to UEBA Cloud as input for email-based anomaly detections.

Data source required: CIM Email.All_Email datamodel (accelerated), populated from o365:graph:messagetrace.

Add-on required: Splunk Add-on for Microsoft Office 365 v6.0.0 or later (required for o365:graph:messagetrace support).

Note: If your environment is ingesting both o365:reporting:messagetrace and o365:graph:messagetrace events, enabling this search might result in duplicate email activity data being forwarded to UEBA Cloud.

Schedule and search configuration

Setting Value
Frequency Every 5 minutes
Search time range (earliest) -24h
Search time range (latest) now
Index-time dispatch earliest -5m
Index-time dispatch latest now
Allow skew 100%
Max event count 1,000,000

Enable the search

This search is disabled by default. To enable it, follow these steps:

  1. Navigate to Settings, then Searches, reports, and alerts.

  2. Filter by App: User and Entity Behavioral Analytics Content .

  3. Find UEBA - OCSF Email Activity - Translation and select Edit > Enable.

Verify the results

Use the fieldsummary block embedded in the ocsf_email_activity_normalization macro (see Step 2 in the 8.6 setup instructions).

Key fields to confirm: email__from, email__to, email__subject, src_endpoint__ip, and status.

Affected detections

Email-based UEBA detections that previously consumed o365:reporting:messagetrace events will receive data from this search. No changes to detection configurations are required. Refer to Behavior-based detection reference for UEBA Cloud for the full list of affected detections.

Macros

The UEBA Content App for Cloud includes the following macro:

ueba_udd_map_network_traffic

Used by: UEBA - Network Traffic Volume Summarization - Summary Gen See the previous section, Saved searches.

Purpose: Maps CIM Network_Traffic datamodel fields to UEBA Dataset field names. To validate field coverage during setup, see Step 2: Verify the mapping macro produces results later in this chapter.

Cautions and restrictions

Although the normalization macros are editable, incorrect changes can break data forwarding to Splunk UEBA Cloud.

CAUTION: Do not modify the app's saved search SPL directly on Splunk Cloud.

Do not modify the normalization macros listed in this table:

Do not modify these configurations Reason Impact
Field data types in SPL toint(), tostring() etc. are required for schema compliance Changing data types will break schema validation in UEBA Cloud
UEBA Dataset fields Fields like connection_info__direction, traffic__bytes_in, actor__user__name are required Missing required fields will cause events to be silently dropped
User and device entity fields UEBA Cloud requires at least one valid user or device entity per event Removing actor__user__name or device fields will cause every event to be dropped
Macro names Referenced directly by the saved searches Renaming macros will break all scheduled searches

Additional restrictions

  • Do not remove required or recommended fields from the normalization macros.

  • Do not modify json_object() calls without understanding the UEBA Dataset. For the full list of mappings, refer to Field mapping for UEBA Content App for Cloud .

  • Do not eave the fieldsummary block active after testing. It replaces per-event rows with summary rows and breaks json_object | collect.

Consequences of invalid changes:

  • Events might be silently dropped by UEBA Cloud with no error surfaced in Splunk.

  • Downstream anomaly detections might not produce findings.

  • Historical data might become incompatible with new data.