UEBA detection annotations are not saved in Content Management in Splunk Enterprise Security 8.5.x

Applicability

Description

UEBA detections delivered by the UEBA content add-on render an editable annotations section in Enterprise Security | Content Management. Editing the annotation values and selecting Save completes without an error, but the values are not written to the detection. Reopening the detection shows the original values.

The behavior is the same for users holding premium administrator roles such as ess_admin and sc_admin, so it is not caused by missing capabilities or write permissions.

Investigation

Follow these steps to confirm the annotations were not committed.

1. Navigate to Enterprise Security > Content Management and open the UEBA detection.
2. Edit an annotation value, save, then reopen the detection and confirm the value reverted.
3. Run the following search to inspect the saved search definition:

| rest splunk_server=local /servicesNS/nobody/DA-ESS-UEBA/saved/searches
| search title="<UEBA detection title>"
| table title eai:acl.perms.write action.correlationsearch.annotations

4. Review the results:

• An empty or absent action.correlationsearch.annotations field confirms the annotation was never written to the detection.
• A populated eai:acl.perms.write field confirms the role is not the limiting factor.

No further role, capability, or app permission troubleshooting is required.

Resolution

UEBA detections are not editable in Splunk Enterprise Security 8.5.x, including their annotations. The editable fields in Content Management are a display-only artifact of the shared detection editor.

To annotate UEBA-driven content, clone the detection and apply annotations to the cloned copy:

1. Navigate to Enterprise Security > Content Management.
2. Locate the UEBA detection, select the row action menu, then select Clone.
3. Save the clone to a local app such as SA-ThreatIntelligence or a custom app, rather than to DA-ESS-UEBA.
4. Open the cloned detection, set the required annotation values, and save.
5. Confirm the values persisted:
   

   | rest splunk_server=local /servicesNS/-/-/saved/searches
   | search title="<cloned detection title>"
   | table title action.correlationsearch.annotations

   
   Support for editing UEBA detections directly is planned for a future release.

Related Links

Add annotations to detections in Splunk Enterprise Security