Tasks you can perform to administer Splunk UBA

As a Splunk UBA admin, you can perform the following tasks to administer Splunk UBA:

Task	More Information
Customize functionality in Splunk UBA to produce more relevant threats and anomalies for your analysts.	Monitor policy violations with custom threats. Take action on anomalies with anomaly action rules. Customize anomaly scoring rules.
Use the command line to configure Splunk UBA and start and stop services.	Start and stop Splunk UBA services from the command line. Manage Splunk UBA configuration properties in the uba-site.properties file.
Manage the users and servers in your deployment and configure authentication options.	Manage user accounts and account roles in Splunk UBA. Configure authentication for Splunk platform users. Configure authentication using single sign-on.
Configure warm standby, restore from automated incremental backups, and migrate configurations to larger clusters.	Perform a full backup before upgrading or migrating Splunk UBA. Prepare automated incremental backups in Splunk UBA. Configure warm standby for in Splunk UBA.
Add different types of data to Splunk UBA.	See Which data sources do I need? in the Get Data into Splunk User Behavior Analytics manual.
Monitor the health of your Splunk UBA deployment.	Use the Splunk UBA Monitoring App to monitor the health of your Splunk UBA deployment from the Splunk platform. See About the Splunk UBA Monitoring app in the Splunk UBA Monitoring App manual. Monitor the health of your Splunk UBA deployment.
Configure integrations with other systems and send data to other systems.	See How Splunk UBA sends and receives data from the Splunk platform in the Send and Receive Data from the Splunk Platform manual. Send Splunk UBA threats to analysts using email. Send threats from Splunk UBA to ServiceNow.
Keep geolocation data up to date in UBA.	See How to manually download the IP database and add it to Splunk User Behavior Analytics (UBA) in Splunk Answers.
Replace Job Manager certificate with a third-party certificate.	See Replace Job Manager certificate with a third-party certificate.