Splunk User Behavior Analytics

Adding IP database to UBA

elauder_splunk
Splunk Employee
Splunk Employee

How to manually download the IP database and add it to Splunk User Behavior Analytics (UBA)?

Labels (1)
1 Solution

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

View solution in original post

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...