Welcome to Splunk UBA 5.0.2

Splunk UBA 5.0.2 is a content release. See About Splunk User Behavior Analytics and release types for more information about the different types of Splunk UBA releases.

If you are new to Splunk UBA, review all the steps in the Splunk UBA installation checklist before installing Splunk UBA.

Planning to upgrade from an earlier version?

If you plan to upgrade to this version from an earlier version of Splunk UBA, read the following documentation before you get started:

• See Upgrade Splunk UBA prerequisites for information you need to know before you upgrade.
• Splunk UBA requires incremental upgrades from earlier versions. See How to install or upgrade to this release of Splunk UBA for upgrade path information.

What's new in 5.0.2

Splunk UBA 5.0.2 contains the following features and enhancements:

New feature or enhancement	Description
Model enhancements	The following content enhancements are available in this release: Rare events models in Splunk UBA are enhanced to provide greater flexibility in the rare combinations of events and scoring that trigger a detection. For example, Splunk UBA can monitor the alarms coming from the Palo Alto Networks firewalls for alarms that have a rare combination of fields. Time series models in Splunk UBA are enhanced for better detection of persistent changes to a metric. For example, VPN server hijacking can be found by detecting the persistent change in the volume of connections originated by the VPN servers. Additional rules and detections are provided for enhanced data loss prevention (DLP) activities. Anomalies related to Box cloud activities are enhanced to provide greater distinction between Box-related activities and file-based activities.
MaxMind database	The MaxMind location database is updated for accurate mapping of IP addresses to geographic locations.