How Splunk UBA sends and receives data from the Splunk platform
Splunk User Behavior Analytics (UBA) can send data to and receive data from the Splunk platform in a variety of ways, as shown in the following figure.
The following table provides additional details about each type of integration between Splunk UBA and Splunk Enterprise Security (ES) and Splunk Enterprise.
|Integration||Configuration||How to Secure||Splunk Add-on for Splunk UBA Required?||Documentation|
|Splunk UBA pushes anomalies and threats to Splunk ES as notable events. Splunk UBA anomalies and threats are stored in Splunk ES as notable events.||Configure the SplunkES output connector in Splunk UBA and connect to port 10008 on the Splunk ES search head.||TLS (store the Splunk root CA certificate in Splunk UBA)||Yes||Send Splunk UBA anomalies and threats to Splunk ES as notable events.|
|Splunk UBA pulls notable events from Splunk ES and stores them in Splunk UBA as External Alarms.||Configure a data source connecter in Splunk UBA and connect to the search head or forwarder port 8089 on Splunk ES.||TLS (store the Splunk root CA certificate in Splunk UBA)||Yes||Pull notable events from Splunk ES to Splunk UBA.|
|Splunk UBA pushes health logs to Splunk Enterprise. Use the Splunk UBA Monitoring App to monitor the health of your Splunk UBA deployment from Splunk Enterprise.||Enable the forwarder embedded in Splunk UBA to forward health logs to the
||TLS (the usual ways to secure forwarder-to-indexer communications)||No||About the Splunk UBA Monitoring app in the Splunk UBA Monitoring App manual.|
|Splunk UBA pushes audit data to Splunk Enterprise for analysis.||Configure the property in the
||TLS (store the Splunk root CA certificate in Splunk UBA)||Yes||Send Splunk UBA audit events to Splunk ES.|
|Splunk Enterprise pushes events directly to Kafka on Splunk UBA.||Splunk UBA issues micro batch queries to the REST API on the Splunk search head on port 8089. The indexers then push the search results back to Kafka on Splunk UBA (port 9093).||TLS (store the Splunk root CA certificate in Splunk UBA)||No||Send data from the Splunk Platform directly to Kafka in the Splunk UBA Kafka Ingestion App manual.|
|Splunk UBA pulls raw events from Splunk Enterprise.||Configure a Splunk connector in Splunk UBA and connect to a Splunk search head on port 8089.||TLS (secure access to Splunk's REST API)||No||Use connectors to add data from the Splunk platform to Splunk UBA in the Get Data into Splunk User Behavior Analytics manual.|
|Use Event Drilldown in Splunk UBA to view raw events in the Splunk platform.||No data is passed. Clicking on the link takes you to Splunk Enterprise, where the raw events query is run. Splunk web (8000/443) and management ports (8089).||TLS (secure access to Splunk's REST API)||No||Use event drilldown to review an anomaly's raw events in Use Splunk User Behavior Analytics.|
About the Splunk Add-on for Splunk UBA
This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 22.214.171.124, 5.0.5