https://community.splunk.com/t5/Splunk-User-Behavior-Analytics/Exclude-audio-video-ips-for-excessive-data-transmission-Data/m-p/654614#M62 <P>tried to add all ip's (basically audio/video streaming sites) in IP whitelist in UBA for excluding uba alert for excessive data transmission/ data exfiltration. However still UBA alerts are getting generated for those ip.<BR />How to tune those alerts in uba.<BR />Also noticed that those waitlisted ips is populated in devices field. Someone can please advise on this<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-08-17 124017.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26831i179118A473271E45/image-size/large?v=v2&amp;px=999" role="button" title="Screenshot 2023-08-17 124017.png" alt="Screenshot 2023-08-17 124017.png" /></span></P> Thu, 17 Aug 2023 07:15:23 GMT Prad_10 2023-08-17T07:15:23Z https://community.splunk.com/t5/Splunk-User-Behavior-Analytics/Exclude-audio-video-ips-for-excessive-data-transmission-Data/m-p/654614#M62 <P>tried to add all ip's (basically audio/video streaming sites) in IP whitelist in UBA for excluding uba alert for excessive data transmission/ data exfiltration. However still UBA alerts are getting generated for those ip.<BR />How to tune those alerts in uba.<BR />Also noticed that those waitlisted ips is populated in devices field. Someone can please advise on this<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-08-17 124017.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/26831i179118A473271E45/image-size/large?v=v2&amp;px=999" role="button" title="Screenshot 2023-08-17 124017.png" alt="Screenshot 2023-08-17 124017.png" /></span></P> Thu, 17 Aug 2023 07:15:23 GMT https://community.splunk.com/t5/Splunk-User-Behavior-Analytics/Exclude-audio-video-ips-for-excessive-data-transmission-Data/m-p/654614#M62 Prad_10 2023-08-17T07:15:23Z