Splunk User Behavior Analytics

Adding IP database to UBA

elauder_splunk
Splunk Employee
Splunk Employee

How to manually download the IP database and add it to Splunk User Behavior Analytics (UBA)?

Labels (1)
1 Solution

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

View solution in original post

elauder_splunk
Splunk Employee
Splunk Employee

Mapping IP addresses to geolocation can enhance your detection models with risk calculations. In UBA, this functionality is achieved using the MaxMind database.

UBA ships with a pre-packaged version of the GeoLite2 Free database. You can choose to download the latest version of that database and run that version instead of the pre-packaged version.

Perform the following steps to download the latest version of the database and run that version in UBA:

If you update UBA, the downloaded, local version of the GeoLite2 Free database takes precedence over the pre-packaged version that ships with UBA. To use the pre-packaged version of the database you must remove the downloaded, local version.

1. Go to https://dev.maxmind.com/geoip/geoip2/geolite2/#Databases

2. Download GeoLite2-City.mmdb.gz and unzip and copy GeoLite2-City.mmdb to the Management Node (node1) as follows:

/etc/caspida/local/conf/etl/geo-db/maxmind

3. Sync cluster:

/opt/caspida/bin/Caspida sync-cluster /etc/caspida/local/conf/etl/geo-db/

4. Restart caspida:

/opt/caspida/bin/Caspida stop-all
/opt/caspida/bin/Caspida start-all

To learn more about IP address geolocation settings in UBA, see Set internal IP range and associated office locations  in the Install and Upgrade UBA manual.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...