Splunk User Behavior Analytics

Adding IP database to UBA

elauder_splunk
Splunk Employee
Splunk Employee

How to manually download the IP database and add it to Splunk User Behavior Analytics (UBA)?

Labels (1)
1 Solution

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

View solution in original post

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...