Splunk® User Behavior Analytics

Use Splunk User Behavior Analytics

This documentation does not apply to the most recent version of Splunk® User Behavior Analytics. For documentation on the most recent version, go to the latest release.

Investigate suspicious activity as a hunter

A hunter investigates suspicious user activity based on data loss prevention alarms and anomalies.

  1. Review current anomalies identified in your environment on the Anomalies Table. Review anomalies on the anomalies table.
  2. Dig deeper into suspicious users on the Users Table. See all users on the user table.
  3. Save filters and create a Custom Dashboard with organization-specific views to monitor suspicious activity. Create a custom dashboard.
Last modified on 30 November, 2023
Investigate and monitor domains   Review anomalies on the anomalies table

This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.4.1, 5.0.5, 5.0.5.1

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters