Splunk® Enterprise Security

Detect Unknown Threats with Behavioral Analytics Service

This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.

Introduction to behavioral analytics service

Behavioral analytics service is a cloud-native user and entity behavioral analytics (UEBA) solution that helps investigative analysts uncover hidden threats. Behavioral analytics service is provisioned on a tenant in Splunk Mission Control. See How do I get behavioral analytics service?

Behavioral analytics service is available on Splunk Cloud Platform in the US East (Virginia) AWS region only.

Behavioral analytics service brings UEBA capabilities to the Splunk Cloud Platform environment. Behavioral analytics service provides comprehensive security visibility to uncover hidden and unknown threats that cannot be easily detected through searches. See How does behavioral analytics service enhance your Splunk SIEM environment?

How does behavioral analytics service enhance your Splunk SIEM environment?

The following image shows how behavioral analytics service can enhance and extend threat hunting in your existing Splunk SIEM environment:

This image shows behavioral analytics service detects unknown unknown and known unknown threats in your environment to expand upon your existing SIEM capabilities. The main elements in the image are described in the table immediately following the image.

Phase Description
Unknown Unknown There are unknown threats in your environment, and the nature of the threats is also unknown. Behavioral analytics service uses the following processes to help uncover hidden threats:
  • Clustering related entities to identify new threats based on peer or group analysis.
  • Profiling entities to find new threats based on multiclass deep neural net classifiers.
Known Unknown Once threats are identified, behavioral analytics service uses the following procedures to further analyze behavioral information and understand the nature of the threat:
  • Predictive analytics to form predictions for when Known Known events might occur in the future.
  • Leveraging known tactics, techniques, and procedures to discover unknown threats.
  • Expert rules enhance or replace complex signature detections.
Known Known Use your existing Splunk SIEM to detect known threats.
  • Correlation rules use raw logs and metadata to correlate known attacks.
  • Discover known threats through shared threat intel.
  • Risk-based priority sorting for notable events.

What do I need to run behavioral analytics service?

Verify that you have the following in order to run behavioral analytics service:

Behavioral analytics service is not available in the following compliant environments:

  • FedRAMP Moderate
  • IL5
  • IRAP

How do I get behavioral analytics service?

In order to get access to behavioral analytics service, you need the following products or services:

Product or service Required? Description
An on-premises heavy forwarder Required The heavy forwarder receives data from on-premises assets and forwards the data to Splunk Mission Control. See Get data into behavioral analytics service for information about how to configure the heavy forwarder.
Access to Splunk Mission Control Required Behavioral analytics service is provisioned on a tenant in Splunk Mission Control.
  • If you already have a Splunk Mission Control tenant, behavioral analytics service is provisioned on your existing tenant.
  • If you are new to Splunk Mission Control, you are granted access to Splunk Mission Control and a tenant where behavioral analytics service is provisioned.

After you are invited to a behavioral analytics service tenant, you must register as a new user before you log in. On the login screen, click register to create a new Splunk Cloud Services account before you log in to your behavioral analytics service tenant.

Splunk Enterprise Security Required Behavioral analytics service ingests asset and identity data from Splunk Enterprise Security (ES) in Splunk Cloud Platform for optimal identity resolution. See How to import assets and identities data from Splunk ES on Splunk Cloud Platform into behavioral analytics service.
Last modified on 11 April, 2022
  What's new in behavioral analytics service

This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters