UBA - How to fix "Enum Mismatch beyond error threshold" errors

Applicability

Description

Errors in Splunk UBA  > "Health Monitor" > "Data Quality Indicator" > "Splunk Direct Data Source Enum Check" INDICATOR

Enum Mismatch beyond error threshold.
Stop the affected data source and make sure UBA is able to understand enum fields. Take one of two actions - 1) modify SPL to make sure values in enum fields should match what's expected in normalize.rules file 2) update normalize.rules to enable UBA to understand incoming data.
Status code ENUM_MISMATCH_BAD.

Investigation

These errors mean there are some invalid values in some of the data source's fields.

To see the exact fields and invalid valid, go to the page "Home" > "Health Monitor" > "Data Quality Indicator" > "Data Source Details" of the data source(s) showing the errors then to find the problematic fields by adding "?system" to the UBA URL.
Example: If the UBA URL looks like the below one :

https://xxxx/#XmsxyOm.

Then you should be able to see the problematic fields after adding "?system" in between "/" and "#" as below

https://xxxx/?system#XmsxyOm.

After adding "?system", "Data Source Details" page should show "Splunk Direct Enum Mismatch" area which should mention the fields which are having invalid value issue in "ENUM FIELD" column.

For example, if getting errors with the "action" field of a datasource "McAfee_NIPS" see field name "action" in "ENUM FIELD" column and the invalid values in "INVALID VALUE" column and number of events for each invalid value in "EVENTS" column.

As mentioned in below documentation, UBA accepts only the values "allowed" and "blocked" for the "action" field.

https://docs.splunk.com/Documentation/UBA/5.4.1/GetDataIn/CIMtoUBAfields#Endpoint_category

action Y The action taken by the endpoint. allowed, blocked

But if there are values coming with other values such as "deferred", "block-url","Attack Blocked","notified" then these values need to be mapped to either "allowed" or "blocked" by adding an "eval" statement to the datasource's SPL to make sure values in enum fields match what is expected in normalize.rules file.

The default (valid values) are listed /opt/caspida/conf/normalize.rules under each field name. This default file should not be edited manually because it will be overwritten during future UBA upgrades.

Resolution

Most likely the SPL will need to be customized to fit the specific case of the current UBA instance.

Below is an example of the eval statement to handle case for Splunk Direct for category Endpoint with action values different than allowed or blocked:

| eval action=case(action="deferred" OR like(lower(action),"%block%"),"blocked",action="notified","allowed",1=1,"allowed")