Splunk® User Behavior Analytics

Use Splunk User Behavior Analytics

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Investigate suspicious activity as a hunter

A hunter investigates suspicious user activity based on data loss prevention alarms and anomalies.

  1. Review current anomalies identified in your environment on the Anomalies Table. Review anomalies on the anomalies table.
  2. Dig deeper into suspicious users on the Users Table. See all users on the user table.
  3. Save filters and create a Custom Dashboard with organization-specific views to monitor suspicious activity. Create a custom dashboard.
Last modified on 30 October, 2018
Investigate and monitor domains
Review anomalies on the anomalies table

This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4,, 5.0.5,, 5.1.0,, 5.2.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters