Detailed Docs now published! https://splunkbase.splunk.com/app/3435/#/details Original Answer: Hi Pavan, Per aaraneta's comment, I'm assuming that you're just referring to the Splunk Security Essentials app (which delivers many use cases found in UEBA products). Let us know if you mean Splunk UBA instead. Today there isn't separate detailed documentation available, but that's something I'm working on building right now. You can look to see it in a few weeks. That said, the goal is for the app to be self-describing to a decent degree. Each use case has a Description, Help, Security Relevance, etc. The app is littered with tooltips to provide contextual information as well. My primary goal with the separate detailed documentation is to describe installation requirements, to help organizations that require documentation before installation to get around that issue. Does that sound like what you're looking for? Is there anything else that you need? ... View more

This is now fixed in version 1.0.1. Thank you for reporting it! The change was to replace the current contents of distsearch.conf with: [replicationBlacklist] excludeSSE1 = ...Splunk_Security_Essentials/lookups... excludeSSE2 = ...Splunk_Security_Essentials\\lookups... ... View more

Not directly, no. However, Splunk ES can ingest anomalies and threats, which can then impact the ES risk score. Out of the box, we will increase the ES risk score for any threats, and you could easily create a new correlation search looking for the anomalies ( index=ueba uba_evt_type=anomaly if my memory serves) that would not create a notable event, but would create a risk entry. That would allow anomalies to also impact your ES risk score. Does that seem like it might meet your needs? ... View more

UBA can ingest email data, and uses it for a variety of use cases. This one in particular, I'm not actually sure whether is done by UBA, but if we can chat offline about your use cases. That said, the descriptions that you're talking about can definitely be done with Core Splunk or ES very easily -- if you (or anyone you work with) has that data in Splunk already then you can happily leverage get that today. ... View more

Splunk UBA implements a variety of machine learning algorithms, including but not limited to Probabilistic Suffix Trees, Markov graphs, and others. However, the specific algorithms implemented, while interesting, should not in our view be a primary aspect of an evaluation. In most cases, there are multiple different algorithms which can detect any particular anomaly. Rather than choosing the “best” academic algorithm, it’s at least as important to implement the selected algorithm properly and tune it in such a way to make it work well at enterprise scale. For instance, just implementing an algorithm to generate a probabilistic suffix tree isn’t enough. The PST algorithm also has to be implemented in such a way that the tree being generated is regularly pruned so as to not just use up all available storage, and that pruning has to be intelligent enough to keep the important things while discarding the others. Applying ML to security problems is definitely one of those situations where implementation matters at least as much as algorithm selection if not more. ... View more

Absolutely UBA can support this, with a minor go-between. UBA pulls data in from Splunk, so we would typically expect to see Bro or Splunk Stream on the SPAN port, sending data into Splunk Enterprise which then UBA would pull. If you wanted to avoid the middle-man of Splunk Enterprise and go directly from SPAN to UBA, you'd need to run Bro which is third party open source software, but very effective and well understood. Bro writes to files, which you could then monitor with syslog-ng or rsyslog and send the events directly to UBA over UDP/TCP syslog. Obviously, depending on the volume of data and what you want to get out of it, you should probably have a deeper conversation with one of the Splunk engineers (full disclosure: I am one of them), but at a high level, you can get data from SPAN to UBA in a few different ways, and it's been done many times by customers. ... View more

Splunk notable events -- absolutely, this is easily doable. If you are using Splunk Enterprise Security, you will find under the Audit menu, a dashboard called Incident Review Audit. This contains a variety of metrics surrounding notable events, but you can always dig deeper and do your own analytics. If you click Open in Search for any of those, you will find searches that start with: | `incident_review` This is a macro for: inputlookup append=T incident_review_lookup | .... Which is where all the incident review activity lives. This should give you all the audit details you could desire for your reporting. ... View more