Splunk UBA Anomalies and Threats

[dania_abujuma]

Hi everyone,

I have started working in Splunk UBA recently, and have some questions:

1. Anomalies:
   • How long does it take to identify anomalies after receiving the logs usually?
   • Can I define anomaly rules?
   • Is there anywhere to explain the existing anomaly categories are based on what or will be looking for what in the traffic?
2. Threats:
   • How long does it take to trigger threats after identifying anomalies?
   • Is there any source I can rely on for creating threat rules? As I am creating rules and testing but with no results.