For some reason all anomalies that use domain names (Suspicious HTTP Redirects, Suspicious Domain Communication, Blacklisted Domain) are only using the IP addresses of my traffic. All of these detections are using Splunk Stream. When I look at the anomalies, it has "The following features increased the suspiciousness of the requests: Domain name being an IP" even though the actual Stream events have the domain names in them. Looking into the stream events it would seem that maybe they are being parsed incorrectly. There is a field listed called "stream.generic.site" which lists the actual domain of the URL and then there is another called "stream.generic.uri_path" that has the rest of the URL. But it looks like UBA is putting the destination IP in the URL when it is correlating the event. What this means is we cannot whitelist domains because UBA isn't even looking at the domains. ... View more

Hello all, We have Splunk UBA and I'm trying to figure out some things. For the Excessive Data Transmission anomaly, I am showing the input as my Checkpoint firewall logs. It seems to be working as I get anomalies triggering. My question is, where is UBA getting the amount of data transferred? When I look at the firewall logs themselves (both in the firewall log server and on Splunk) there doesn't seem to be any data relating to amount of data transferred. Thanks ... View more

Hello everyone, I have a deployment server that manages most of our Splunk apps, but when everything was setup, some apps were installed unmanaged. In particular we have a Checkpoint app on one of our heavy forwarders that isn't managed by the deployment server. We are trying to move all unmanaged apps to the deployment server to make administration easier. Is there any process to create this link without redeploying the app? Thanks! Jacob ... View more