UBA - How to fix Broken UBA Links in Splunk ES caused by an incorrect hostname in the UBA Settings

Applicability

Description

In Splunk ES, UBA notable alerts include URLs that link to the UBA interface for detailed threat analysis. When these URLs contain an incorrect hostname or IP address, users encounter broken links that prevent access to UBA threat details.

Investigation

- The URL in the ES notable alerts was found to have a typo in the hostname or IP address field configured in UBA Settings > Alerts.
- The incorrect hostname caused the URL to return an error page when accessed.
- Verification of the UBA Settings revealed the hostname was set to an outdated or incorrect value.

Resolution

1. Access the Splunk UBA UI as admin user and go to Settings > Alerts page.
2. Locate the field labeled Hostname (or IP address) of your Splunk UBA's UI server.
3. Update this field to the correct hostname of the UBA management node, for example: uba1
4. Save the changes. The UBA services will restart to apply this change.
5. Verify that new UBA notables now contain URLs with the corrected hostname.
6. For existing alerts with broken URLs, manually append the missing characters to the hostname portion of the URL as a temporary workaround.

Related Links

-Splunk User Behavior Analytics Documentation