All Apps and Add-ons

UBA user risk score

dellytaniasetia
Explorer

Hi

can I get user risk score in UBA from Splunk ES search command, given the user name.

Thanks,

0 Karma
1 Solution

David
Splunk Employee
Splunk Employee

Not directly, no. However, Splunk ES can ingest anomalies and threats, which can then impact the ES risk score. Out of the box, we will increase the ES risk score for any threats, and you could easily create a new correlation search looking for the anomalies (index=ueba uba_evt_type=anomaly if my memory serves) that would not create a notable event, but would create a risk entry. That would allow anomalies to also impact your ES risk score.

Does that seem like it might meet your needs?

View solution in original post

David
Splunk Employee
Splunk Employee

Not directly, no. However, Splunk ES can ingest anomalies and threats, which can then impact the ES risk score. Out of the box, we will increase the ES risk score for any threats, and you could easily create a new correlation search looking for the anomalies (index=ueba uba_evt_type=anomaly if my memory serves) that would not create a notable event, but would create a risk entry. That would allow anomalies to also impact your ES risk score.

Does that seem like it might meet your needs?

dellytaniasetia
Explorer

Hello,

How about to get daily dynamic lookup from UBA containing high-risk user? is it possible?

thanks again

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...