Search for detections from Splunk Mission Control

You can search for behavioral analytics service detections using search in Splunk Mission Control. See Supported detections in behavioral analytics service for a list of supported detections.

You can search the ueba_cloud_detection_events index from Splunk Mission Control to find detections by severity, or within a specific period of time.

Perform the following steps to search for detections:

1. Click Search in the Splunk Mission Control menu bar.
2. In the search field, enter the desired search.

The following example search returns detections with a LOW risk severity:

| from ueba_cloud_detection_events | where risk_severity="LOW"

The following example search returns detections that occurred within the last 5 minutes:

| from ueba_cloud_detection_events | where earliest=-5m@m AND latest=@m

See Search in Splunk Mission Control in the Triage and Respond to Notables in Splunk Mission Control manual for more information about using search in Splunk Mission Control.