[UBA] Enum mismatch beyond error threshold

Applicability

Description

The datasource is sending logs containing information that UBA is unable to interpret.

Investigation

1. Log in to UBA GUI with an admin account
2. On Health monitor page, expand on the warning/error to identify which datasource is being flagged
3. Go to Manage > Data Sources > Click on the identified datasource
4. Append "?system" to the URL before the hashtag symbol to get more information
   • For example: https://<UBA url>/#Y2FzcGlkYS5kYXRhU291cmNlcy5tYWluVmlldw==
   • Change to: https://<UBA url>/?system#Y2FzcGlkYS5kYXRhU291cmNlcy5tYWluVmlldw==
5. Identify the invalid/ambiguous value for the respective field shown on the datasource page
6. Run the datasource SPL on the SH that UBA is querying from, verify that the flagged field is indeed providing invalid/ambiguous values

Resolution

Ensure that the field values align with the Splunk CIM model and adhere to the appropriate data categories.  This can be achieved by using the eval command in the Datasource SPL to modify the field values. For example, a network traffic log containing invalid/ambiguous value for action field:

• | eval action=case(action="deferred" OR like(lower(action),"block%"),"blocked",action="notified","allowed",1=1,"allowed")

Related Links

Community Post: How to fix "Enum Mismatch beyond error threshold" error

UBA Health Monitor Status: ENUM_MISMATCH_BAD

Splunk UBA category to Splunk CIM field reference