UEBA behavior-based detections not appeared on Content Management UI

Applicability

Description

UEBA behavior-based detections not appeared on Content Management UI. 

Investigation

After the UEBA Content App is installed on the ES search head cluster, behavior-based detections do not appear in Content Management UI.

The following symptoms were observed:

• The "Type" filter on the Content Management page has no "Behavior-based detection" option.
• Going directly to the filtered view still shows no UEBA detections:
  https://<search_head>:8000/en-GB/app/SplunkEnterpriseSecuritySuite/ess_content_management?typeFilter=cmp_ba_detections
• The UEBA detections run normally and appear under Settings > Searches, Reports, and Alerts. 
• The same result occurs for the ES admin user and the Splunk local `admin` user.
• The app metadata is exported to `system` with global sharing.
• The ES banner shows the Premier license.

In the HAR file, compare these two requests from the same page load:

1.  `GET /services/apps/local?output_mode=json` (the bare call)
2.  The `content_management/appsandservices` request

A positive match looks like this:

The bare call returns exactly 30 entries, and `DA-ESS-UEBAContent` is not among them.

The `appsandservices` call returns the full app list, including `DA-ESS-UEBAContent`.

Verify the issue applicability: 

Count the apps whose names sort alphabetically before `DA-ESS-UEBAContent`, using the directory listing of `$SPLUNK_HOME/etc/apps` on a member. 

ls -1 "$SPLUNK_HOME/etc/apps" | sort -f | nl -ba

If there are 30 or more, the issue applies.

Problematic example below from test lab: 

Resolution

This is a known issue, the fix is included in ES 8.8 release.

Workaround: 

Option 1:
Rename apps: Modify the names of apps listed alphabetically before DA-ESS-UEBAContent, ensuring that DA-ESS-UEBAContent appears within the first 30 apps when sorted alphabetically.

Option 2: 
Manage detections elsewhere: Manage the detections and saved searches from Searches, Reports, and Alerts. All detections and saved searches in the DA-ESS-UEBAContent app remain functional and accessible there.