Upgrade to UEBA on-premises version 8.8

important steps when upgrading to UEBA on-premises version 8.8

If you are upgrading to version 8.8 after having already installed a previous version of Splunk Enterprise Security and the UEBA Content App, perform the upgrade in the following order.

Note: The order of upgrade steps is important. There is no automatic correction for upgrades made in a different order.

  1. Upgrade Splunk Enterprise Security to 8.8.

    Follow the instructions in Planning an upgrade of Splunk Enterprise Security in the Install Splunk Enterprise Security documentation.

  2. Upgrade the UEBA Content App (DA-ESS-UEBAContent) to 8.8.

    Follow the instructions in Install the UEBA Content App for On-premises.

  3. Turn off the existing Summarization Searches and use the UEBA Pipeline Management page to turn on the UEBA Detection Dataset Summarization Searches for your environment.

    For details, see the next section, Switch to using UEBA Detection Dataset (UDD) in version 8.8.

    Note: Do not run both existing summary searches and the new UEBA detection dataset summarization searches at the same time; doing this will duplicate input data to the searches and cause inaccurate Findings.

After a successful upgrade, performed in the correct order, you will see the following:

  • Your existing Summarization Search: preserved, still running; no further action required

  • Enabled/disabled state of your UEBA Detection: preserved; no further action required

  • Some contributing event search behavior has changed for some detections. For example, authentication now supports both UDD and CIM field shapes and time windows are explicit and can be narrower than the daily detection window.

Switch to using UEBA Detection Dataset (UDD) in version 8.8

Beginning with UEBA version 8.8, there is a new data format named UEBA Detection Dataset (UDD). Your detections running on legacy summarization searches will still function properly, but it is best to switch to UEBA Dataset Management to enable and validate mappings for your detections.

To switch to using UEBA Detection Dataset (UDD), follow these steps:

  1. In Enterprise Security, select Settings (the gear icon).

  2. Select Searches, report, and alerts.

  3. In the App menu, select User and Entity Behavioral Analytics Content (DA-ESS-UEBAContent).

  4. In the search bar, locate the Legacy Summarization Searches before 8.8.0 search corresponding to the table below. For example, find UEBA - AD Device Access Summarization - Summary Gen.

  5. From the Edit menu, select Disable.

  6. Locate the corresponding transformation from UEBA Dataset Management. From the Edit menu, select Enable.

Legacy Summarization Searches before 8.8 Default Tranformations
UEBA - AD Device Access Summarization - Summary Gen Authentication (default)
UEBA - Unusual Login Authentication Summarization - Summary Gen Authentication (default)
UEBA - Unusual Network Traffic Volume Summarization - Summary Gen Network Activity (default)
UEBA - Unusual Printer Volume Summarization - Summary Gen Base Printer (default)
UEBA - Unusual Volume USB Per User Summarization - Summary Gen Base USB (default)

New UDD-generating summarization searches in 8.8 correspond to these new transformations. To configure those summarization searches, see Manage UEBA detection datasets .

Reference information

Several components have minor changes to their names. Refer to the following subsections for information on changes made in version 8.8.

Saved searches

Starting with release 8.8, some saved searches names have been updated to correct naming inaccuracies from previous releases.

Legacy name (before ES 8.8) Name in ES 8.8 (UEBA 8.8) Notes
UEBA - Brute Force Authentication Per User Feature Count - Summary Gen UEBA - Brute Force Authentication per User Feature Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per User Feature Type - Summary Gen UEBA - Brute Force Authentication per User Feature Type - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per User Feature Vol Count - Summary Gen UEBA - Brute Force Authentication per User Feature Vol Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per User Feature Vol Type - Summary Gen UEBA - Brute Force Authentication per User Feature Vol Type - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per Device Feature Count - Summary Gen UEBA - Brute Force Authentication per Device Feature Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Brute Force Authentication Per Device Feature Vol Count - Summary Gen UEBA - Brute Force Authentication per Device Feature Vol Count - Feature Gen The producer is represented as a feature in ES 8.8.
UEBA - Unusual Network Traffic Volume Per User Feature Download - Summary Gen UEBA - Network Traffic Volume per User Feature Download - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Upload - Summary Gen UEBA - Network Traffic Volume per User Feature Upload - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Download - Summary Gen UEBA - Network Traffic Volume per Device Feature Download - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Upload - Summary Gen UEBA - Network Traffic Volume per Device Feature Upload - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Outgoing Connections - Summary Gen UEBA - Network Traffic Volume per Device Feature Outgoing Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Upload DMZ Devices - Summary Gen UEBA - Network Traffic Volume per User Feature Upload To DMZ Devices - Feature Gen The producer is represented as a feature, and the name identifies uploads to DMZ devices more explicitly.
UEBA - Unusual Network Traffic Volume Per Device Feature Blocked Connections - Summary Gen UEBA - Network Traffic Volume per Device Feature Blocked Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Blocked Connections - Summary Gen UEBA - Network Traffic Volume per User Feature Blocked Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per Device Feature Bytes - Summary Gen UEBA - Network Traffic Volume per Device Feature Bytes - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Per User Feature Download Internal Server - Summary Gen UEBA - Network Traffic Internal Server per User Feature Download - Feature Gen The producer is represented as a feature, and the name identifies the internal-server scope more directly.
UEBA - Unusual Network Traffic Volume Per User Feature Outgoing Connections - Summary Gen UEBA - Network Traffic Volume per User Feature Outgoing Connections - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Device Feature Data Transmitted - Summary Gen UEBA - Printer Volume per Device Feature Data Transmitted - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Device Feature Print - Summary Gen UEBA - Printer Volume per Device Feature Print - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Device Feature Time - Summary Gen UEBA - Printer Volume per Device Feature Time - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Printer Feature Data Transmitted - Summary Gen UEBA - Printer Volume per Printer Feature Data Transmitted - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Printer Feature Print - Summary Gen UEBA - Printer Volume per Printer Feature Print - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per Printer Feature Time - Summary Gen UEBA - Printer Volume per Printer Feature Time - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per User Feature Data Transmitted - Summary Gen UEBA - Printer Volume per User Feature Data Transmitted - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per User Feature Print - Summary Gen UEBA - Printer Volume per User Feature Print - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Printer Volume per User Feature Time - Summary Gen UEBA - Printer Volume per User Feature Time - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB Bytes Read Feature - Summary Gen UEBA - USB Volume Bytes Read Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB Bytes Write Feature - Summary Gen UEBA - USB Volume Bytes Write Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB Denies Feature - Summary Gen UEBA - USB Volume Denies Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Volume USB File Operations Feature - Summary Gen UEBA - USB Volume File Operations Feature - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Login Authentication Per User Feature Login - Summary Gen UEBA - Login Authentication per User Feature Login - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Login Authentication Per User Feature Unlock - Summary Gen UEBA - Login Authentication per User Feature Unlock - Feature Gen The producer is represented as a feature, and the non-detection Unusual prefix is removed.
UEBA - Unusual Network Traffic Volume Summarization - Summary Gen UEBA - Network Traffic Volume Summarization - Summary Gen The UDD-named counterpart removes Unusual because this summarization does not identify anomalous activity. The legacy search also remains in ES 8.8.
UEBA - Unusual Network Traffic Volume Per User Consolidation - Summary Gen UEBA - Network Traffic Volume per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Network Traffic Volume per Device Consolidation - Summary Gen UEBA - Network Traffic Volume per Device Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Printer Volume per Device Consolidation - Summary Gen UEBA - Printer Volume per Device Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Printer Volume per Printer Consolidation - Summary Gen UEBA - Printer Volume per Printer Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Printer Volume per User Consolidation - Summary Gen UEBA - Printer Volume per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Volume USB Per User Consolidation - Summary Gen UEBA - USB Volume per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares data rather than identifying unusual activity.
UEBA - Unusual Login Authentication Device Lookup - Feature Gen UEBA - Login Authentication Device Lookup - Feature Gen The prefix is removed because this saved search only builds a user-to-device mapping. It does not identify unusual activity.
UEBA - Unusual Login Authentication Per User Consolidation - Summary Gen UEBA - Login Authentication per User Consolidation - Summary Gen The prefix is removed because this consolidation prepares authentication data rather than identifying unusual activity.
UEBA - Unusual Network Traffic Volume Device Lookup - Feature Gen UEBA - Network Traffic Volume Device Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Network Traffic Volume User Lookup - Feature Gen UEBA - Network Traffic Volume User Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Printer Volume Device Lookup - Feature Gen UEBA - Printer Volume Device Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Printer Volume User Lookup - Feature Gen UEBA - Printer Volume User Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Volume USB Device Lookup - Feature Gen UEBA - USB Volume Device Lookup - Feature Gen The prefix is removed because this saved search builds a lookup rather than identifying unusual activity.
UEBA - Unusual Volume Of Blocked Connections Per User Scoring - Scoring UEBA - Unusual Volume of Blocked Connections per User Scoring - Scoring The saved-search stanza uses the new release name. Its scoring role remains unchanged.
UEBA - Unusual Volume Of Outgoing Connections Per User Scoring - Scoring UEBA - Unusual Volume of Outgoing Connections per User Scoring - Scoring The saved-search stanza uses the new release name. Its scoring role remains unchanged.
UEBA - Unusual Volume of Data Transmitted to Printer per Device_scoring - Scoring UEBA - Unusual Volume of Data Transmitted to Printer per Device Scoring - Scoring The malformed scoring-name form is replaced with the standard scoring-name form.
UEBA - Unusual Volume of Print per Device scoring - Scoring UEBA - Unusual Volume of Print per Device Scoring - Scoring The saved-search stanza uses the standard scoring-name form.

Search Macros

Several macros are renamed to add prefix them with the ueba_ namespace.

Legacy name (before ES 8.8) Name in ES 8.8 (UEBA 8.8)
security_content_ctime(1) ueba_security_content_ctime(1)
security_content_summariesonly ueba_security_content_summariesonly

The following macros have a duplicate counterpart in ES 8.8 to support the UEBA Detection Dataset (UDD) format. ES 8.8 contains both versions of the macros.

Legacy name (before ES 8.8) Name in ES 8.8 (UEBA 8.8) Notes
unusual_network_traffic_volume_data_map(1) ueba_udd_map_network_traffic(1) The new macro is the public UDD mapping entry point and delegates to ueba_udd_cim_map_network_traffic(1). The legacy macro remains in ES 8.8.
unusual_login_authentication_data_map ueba_udd_cim_map_authentication(1) and ueba_udd_normalize_authentication The new search path separates CIM-to-UDD mapping from login-authentication normalization. This is not a one-to-one rename, and the legacy macro remains.
ueba_ad_auth_data_map ueba_udd_cim_map_authentication(1) and ueba_udd_normalize_ad_authentication The new search path uses the shared authentication mapper followed by AD-specific normalization. This is not a one-to-one rename, and the legacy macro remains.
unusual_printer_volume_data_map ueba_udd_map_printer_activity(1) The new macro maps printer events into UDD fields. The legacy macro remains in ES 8.8.
unusual_usb_volume_data_map ueba_udd_cim_map_usb_activity(1) The new macro maps USB activity into UDD fields. The legacy macro remains in ES 8.8.
unusual_network_traffic_volume_contributing_events(1) unusual_network_traffic_volume_contributing_events_udd(1) The new macro retrieves contributing events using UDD fields. The legacy contributing-events macro remains in ES 8.8.

Transforms

The following transforms are renamed to add prefix them with the ueba_ namespace.

Legacy name (before ES 8.8) Name in ES 8.8 (UEBA 8.8)
cloud_storage_sites_lookup ueba_cloud_storage_sites_lookup
http_unusual_job_search_activity ueba_http_unusual_job_search_activity
http_unusual_traffic_to_anonymizing_sites ueba_http_unusual_traffic_to_anonymizing_sites

Knowledge objects

Starting with release 8.8, some knowledge objects have new names. For details, see Knowledge objects for UEBA .