UBA - "Sending Threats to Enterprise Security is halted" error on GUI

Applicability

UBA 5.x.x OS: RHEL/Ubuntu/Linux

Description

UBA includes feature configuration to push events such as anomalies/threats externally to Splunk Enterprise Security using  "Output Connectors" configuration. The communication between UBA and Splunk ES needs to have a secured communication between them using SSL communication over port 10008.

Any issue on either side is mostly attributed with a certificate issue (Expired/Old/Renewed certificates etc) which in turn can break the established connection between UBA and ES via output connector configuration.

Investigation

On Enterprise Security:

Step 1: Verify that the "inputs.conf" is correctly configured as a part of configuring ES to receive events from UBA.

Step 2: Restart Splunk Enterprise once above configuration is verified:

• In Splunk Web, select System > Server controls.
• Click Restart Splunk.

Step 3: Verify that SSL is enabled for port 10008 under:

$SPLUNK_HOME/var/log/splunk/splunkd.log

For example:

11-07-2019 15:07:42.661 -0800 INFO  TcpInputProc - Creating raw Acceptor for IPv4 port 10008 with SSL

On UBA:

Step 1: Login to UBA CLI as user "caspida" and go to the following path:

cd /var/log/caspida

Step 2: Open the "outputconnectors.log" file from the above path and find the reason for the error being thrown. For example:

2023-04-19 02:18:32,931 WARN OutputConnectorTopic-consumer com.caspida.common.utils.Utils$: Attempt #2 failed: com.caspida.connectors.output.SplunkESConnectorException: SplunkESConnector: Failed to create connection to push data to ES at (https://wlac-core-sa/, 10008) at com.caspida.connectors.output.SplunkESConnector.getSocketOut(SplunkESConnector.scala:269) at com.caspida.connectors.output.SplunkESConnector.$anonfun$logMsg$1(SplunkESConnector.scala:232)

Resolution

Step 1: Copy the latest rootCA certificate from ES on to UBA under /home/caspida

Step 2: Delete any existing entry for the old certificate using the alias "splunk es"

sudo keytool -delete -alias "splunk es" -keystore /etc/alternatives/jre_openjdk/lib/security/cacerts

Step 3: Import the rootCA certificate that was copied from ES to UBA under /home./caspida using the following command:

• On RHEL Systems, use the following command:

sudo keytool -import -alias "splunk es" -keystore $JAVA_HOME/lib/security/cacerts -file ~/cacert.pem

• On other Linux systems, use the following command:

sudo keytool -import -alias "splunk es" -keystore $JAVA_HOME/jre/lib/security/cacerts -file ~/cacert.pem

Step 4: When prompted, type the keystore password and trust the certificate. The default keystore password is changeit.

Step 5: Restart the output connector on UBA:

sudo service caspida-outputconnector restart

Step 6: Verify that no SSL errors are triggering now:

tail -f /var/log/caspida/outputconnector.log

Step 7: On ES, check index "ueba" if new events have started to get populated:

index=ueba

Related Links

https://docs.splunk.com/Documentation/UBA/5.2.0/Integration/PushUBAcontenttoES#Configure_the_Splunk_platform_to_receive_data_from_the_Splunk_UBA_output_connector

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release