Hello @philwong, I understand that you're facing issues after changing the IP of your UBA (User and Entity Behavior Analytics) instance due to infrastructure changes. It seems that a part of the UBA is not coming up properly, and you've identified that this might be due to a jammed state related to the Docker socket (`docker.sock`). While you've come across solutions suggesting adding the user to the `/var/run/docker.sock` permission group, you've also mentioned that the user "caspida" already has permission to execute all commands using `sudo`. This raises questions about whether this could be the root cause of the issue. Additionally, you've noted that all configurations seem to be tied to the hostname rather than the IP, which makes you uncertain about why changing the IP would lead to these problems. Considering your situation, here are some steps you might want to explore: 1. Follow Official Documentation: First and foremost, I recommend referring to the official documentation for changing IP in UBA, which can be found here: https://docs.splunk.com/Documentation/UBA/5.2.0/Admin/ChangeIP. This document should provide comprehensive guidance on handling IP changes. 2. Stop UBA Components: Before proceeding with any changes, ensure that you stop all UBA components by executing the following command: /opt/caspida/bin/Caspida stop-all 3. Change IP: Use the provided utility script to change the IP: /opt/caspida/bin/utils/change-uba-network-address.sh -s <old-ip> <new-ip> If your UBA instance was running the UI on the old IP, consider recreating SSL certificates for the web server after the IP change using: /opt/caspida/bin/CaspidaCert.sh 4. Containerization Setup: It seems you've identified the use of containerization in your UBA setup. To address the Docker socket issue, try the following steps: /opt/caspida/bin/Caspida remove-containerization /opt/caspida/bin/Caspida setup-containerization /opt/caspida/bin/Caspida start-containers 5. Restart UBA Components: Finally, restart the UBA components: /opt/caspida/bin/Caspida start-all These steps should help in resolving the issue you're facing after changing the IP of your UBA instance. However, if the problem persists, it might be worth considering reaching out to UBA support for more personalized assistance based on your specific setup and configuration. ... View more

Hello @neerajs_81, You can access the list of closed threats by applying the following filters on both the Threat Review page and the Threats Table UI screen: "Threat Status - Closed by User" and "Threat Status - Closed by System". This will allow you to conveniently view the closed threats and their details. ... View more