Splunk User Behavior Analytics

Adding IP database to UBA

elauder_splunk
Splunk Employee
Splunk Employee

How to manually download the IP database and add it to Splunk User Behavior Analytics (UBA)?

Labels (1)
1 Solution

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

View solution in original post

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...