Adding IP database to UBA

elauder_splunk — Wed, 30 Mar 2022 23:16:00 GMT

How to manually download the IP database and add it to Splunk User Behavior Analytics (UBA)?

Re: Adding IP database to UBA

elauder_splunk — Wed, 30 Mar 2022 23:24:55 GMT

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all

/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations in the Install and Upgrade UBA manual.

topic Re: Adding IP database to UBA in Splunk User Behavior Analytics

Adding IP database to UBA

Re: Adding IP database to UBA