Splunk® Enterprise Security

Detect Unknown Threats with Behavioral Analytics Service

This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.

Search for detections from Splunk Mission Control

You can search for behavioral analytics service detections using search in Splunk Mission Control. See Supported detections in behavioral analytics service for a list of supported detections.

You can search the ueba_cloud_detection_events index from Splunk Mission Control to find detections by severity, or within a specific period of time.

Perform the following steps to search for detections:

  1. Click Search in the Splunk Mission Control menu bar.
  2. In the search field, enter the desired search.

The following example search returns detections with a LOW risk severity:

| from ueba_cloud_detection_events | where risk_severity="LOW"

The following example search returns detections that occurred within the last 5 minutes:

| from ueba_cloud_detection_events | where earliest=-5m@m AND latest=@m

See Search in Splunk Mission Control in the Triage and Respond to Notables in Splunk Mission Control manual for more information about using search in Splunk Mission Control.

Last modified on 10 January, 2022
Search for enriched events from Splunk Mission Control   Search for an entity's risk score history from Splunk Mission Control

This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.0


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters