Splunk® User Behavior Analytics

Use Splunk User Behavior Analytics

Investigate suspicious activity as a hunter

A hunter investigates suspicious user activity based on data loss prevention alarms and anomalies. You can take the following actions to investigate suspicious user activity in Splunk UBA:

  1. Review current anomalies identified in your environment on the Anomalies Table. See, Review anomalies on the anomalies table.
  2. Dig deeper into suspicious users on the Users Table. See, See all users on the user table.
  3. Save filters and create a Custom Dashboard with organization-specific views to monitor suspicious activity. See, Create a custom dashboard.
Last modified on 30 November, 2023
Investigate and monitor domains   Review anomalies on the Anomalies Table

This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.1.0,, 5.2.0, 5.2.1, 5.3.0, 5.4.0

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters