Use case to report on users who are accessing systems or data that is not within their regular usage?

[vikkysplunk]

Hi All, is any one created Use case to report on users who are accessing systems or data that is not within their regular usage?

[richgalloway]

That sounds like Splunk UBA (User Behavior Analytics).  See https://www.splunk.com/en_us/software/user-behavior-analytics.html

[vikkysplunk]

@richgalloway Hi, is there any way we can create the use case for "Use case to report on users who are accessing systems or data that is not within their regular usage profile " in splunk with out using UBA?

[richgalloway]

Is there a way?  Probably.  If it was easy, though, Splunk wouldn't have bought UBA.