UEBA detection reference for UEBA on-premises
The following UEBA detections are available in on-premises deployments of Splunk Enterprise Security.
Each of these detections is disabled by default. If you have previously enabled a detection, upgrading to a new version of Enterprise Security or UEBA will not disable them.
| Detection name | Detection type | Data source |
|---|---|---|
| UEBA - AWS Compromised Account - Rule | Rule | Risk Index |
| UEBA - Brute Force Access Behavior Per Device - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Behavior Per Device By Business Unit - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Behavior Per Device By Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Behavior Per User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Behavior Per User by Business Unit - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Behavior Per User by Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Logon Type Per User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Logon Type Per User by Business Unit - Rule | ML | Authentication UEBA Dataset |
| UEBA - Brute Force Access Logon Type Per User by Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Cloud Unusual File Extension Access - Rule | Rule | File Hosting Activity |
| UEBA - Compromised Linux Host Correlation - Rule | Rule | Risk Index |
| UEBA - Compromised Windows Host Correlation - Rule | Rule | Risk Index |
| UEBA - Email over 5 MB Sent to Personal Email - Rule | Rule | Email CIM datamodel |
| UEBA - Email Sent to Disposable Email Provider - Rule | Rule | Email CIM datamodel |
| UEBA - Email Sent to Personal Email Using Same Alias - Rule | Rule | Email CIM datamodel |
| UEBA - Email Sent to Personal Email with Attachment - Rule | Rule | Email CIM datamodel |
| UEBA - Email Sent to Personal Email with Privacy Keywords - Rule | Rule | Email CIM datamodel |
| UEBA - Failed Access Multiple Users - Rule | Rule | Base Badge UEBA Dataset |
| UEBA - Failed Badge Entry Multiple Doors - Rule | Rule | Base Badge UEBA Dataset |
| UEBA - Http Excessive Transfer to Storage Site - Rule | Rule | Web CIM datamodel |
| UEBA - Http Suspicious Domain File Download - Rule | Rule | Web CIM datamodel |
| UEBA - Http Unusual Job Search Activity - Rule | Rule | Web CIM datamodel |
| UEBA - Http Unusual Traffic to Anonymizing Sites - Rule | Rule | Web CIM datamodel |
| UEBA - Large Office 365 Message Flagged by DLP Policy - Rule | ML | DLP CIM datamodel |
| UEBA - Member Added Removed In Short Span Global Groups - Rule | Rule | Change CIM datamodel |
| UEBA - Member Added Removed In Short Span Universal Groups - Rule | Rule | Change CIM datamodel |
| UEBA - Office 365 DLP Policy Violations Allowed - Rule | ML | DLP CIM datamodel |
| UEBA - Password Policy Circumvention - Rule | Rule | Change CIM datamodel |
| UEBA - PGA File Extension Printed - Rule | Rule | Base Printer UEBA Dataset |
| UEBA - Potential Confidential Documents Printed - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Rare Badge Reader Access - Rule | ML | Base Badge UEBA Dataset |
| UEBA - Rare Device Login By Windows User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Login Return Code By Device - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Login Return Code By Windows User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Windows Domain Login By User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Windows Logon Process By Device - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Windows Logon Process By User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Windows Logon Process By User And Device - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Windows Logon Type By Device - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Windows Logon Type By User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Rare Windows User Login By Device - Rule | ML | Authentication UEBA Dataset |
| UEBA - Short Lived Windows Accounts - Rule | Rule | Change CIM datamodel |
| UEBA - Suspicious File Transfer - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unauthorized Activity Time - Rule | Rule | Authentication CIM datamodel |
| UEBA - Unauthorized Login Type - Rule | Rule | Authentication CIM datamodel |
| UEBA - Unauthorized Machine Login - Rule | Rule | Authentication CIM datamodel |
| UEBA - Unusual Login Time Per User - Rule | Rule | Authentication UEBA Dataset |
| UEBA - Unusual Login Time Per User By Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Print Time per Device - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Print Time per Printer - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Print Time per User - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Time of Badge Access per User - Rule | Rule | Base Badge UEBA Dataset |
| UEBA - Unusual Unlock Time Per User - Rule | Rule | Authentication UEBA Dataset |
| UEBA - Unusual Unlock Time Per User By Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Login Type Per User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Login Type Per User by Business Unit - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Login Type Per User by Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Of Badge Accesses Per User - Rule | ML | Base Badge UEBA Dataset |
| UEBA - Unusual Volume of Blocked Connections per Device - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Blocked Connections per Device by Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Blocked Connections per Device by Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Blocked Connections Per User - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Blocked Connections Per User By Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Blocked Connections Per User By Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Bytes Read From USB Per User - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of Bytes Read From USB Per User By Company - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of Bytes Written To USB Per User - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of Bytes Written To USB Per User By Company - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume of Data Bytes per Device - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Bytes per Device by Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Bytes per Device by Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded From Internal Server Per User - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded From Internal Server Per User By Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded From Internal Server Per User By Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per Device - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per Device by Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per Device by Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per User - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Downloaded Per User By Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Downloaded per User by Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Device - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Device by Business Unit - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Device by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Printer - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Printer by Business Unit - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per Printer by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per User - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume Of Data Transmitted To Printer Per User By Business Unit - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Transmitted to Printer per User by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per Device - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per Device by Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per Device by Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per User - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of Data Uploaded Per User By Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded per User by Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded To DMZ Devices Per User - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded To DMZ Devices Per User By Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Data Uploaded To DMZ Devices Per User By Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume Of File Operations To USB Per User - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of File Operations To USB Per User By Company - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections per Device - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections per Device by Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections per Device by Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections Per User - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections Per User By Business Unit - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Outgoing Connections Per User By Company - Rule | ML | Network Traffic UEBA Dataset |
| UEBA - Unusual Volume of Print at Unusual Time per Device by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print at Unusual Time per Printer by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print at Unusual Time per User by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per Device - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per Device by Business Unit - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per Device by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per Printer - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per Printer by Business Unit - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per Printer by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per User - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume Of Print Per User By Business Unit - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume of Print per User by Company - Rule | ML | Base Printer UEBA Dataset |
| UEBA - Unusual Volume Of USB Denies Per User - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Of USB Denies Per User By Company - Rule | ML | Base USB UEBA Dataset |
| UEBA - Unusual Volume Success Login Per User - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Success Login Per User by Business Unit - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Success Login Per User by Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Success Logins To Computer - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Success Logins To Computer By Business Unit - Rule | ML | Authentication UEBA Dataset |
| UEBA - Unusual Volume Success Logins To Computer By Company - Rule | ML | Authentication UEBA Dataset |
| UEBA - Windows Event Log Cleared - Rule | Rule | Change CIM datamodel |