Tasks you can perform to administer Splunk UBA

As a Splunk UBA admin, you can perform the following:

Task	More Information
Customize functionality in Splunk UBA to produce more relevant threats and anomalies for your analysts.	Monitor policy violations with custom threats. Take action on anomalies with anomaly action rules. Customize anomaly scoring rules.
Use the command line to configure Splunk UBA and start and stop services.	Start and stop Splunk UBA services from the command line. Manage Splunk UBA configuration properties in the uba-site.properties file.
Manage the users and servers in your deployment and configure authentication options.	Manage user accounts and account roles in Splunk UBA. Configure authentication for Splunk platform users. Configure authentication using single sign-on.
Configure warm standby, restore from automated incremental backups, and migrate configurations to larger clusters.	Configure warm standby in Splunk UBA. Prepare to backup Splunk UBA.
Add different types of data to Splunk UBA.	See Which data sources do I need? in the Get Data into Splunk User Behavior Analytics manual.
Monitor the health of your Splunk UBA deployment.	Use the Splunk UBA Monitoring App to monitor the health of your Splunk UBA deployment from the Splunk platform. See About the Splunk UBA Monitoring app in the Splunk UBA Monitoring App manual. Monitor the health of your Splunk UBA deployment.
Configure integrations with other systems and send data to other systems.	See How Splunk UBA sends and receives data from the Splunk platform in the Send and Receive Data from the Splunk Platform manual. Send Splunk UBA data to Splunk Enterprise without Splunk Enterprise Security. Send Splunk UBA threats to analysts using email. Send threats from Splunk UBA to ServiceNow.