UBA - How to verify Threat revalidation completed after Anomaly Action Rule is executed successfully

Applicability

Description

After an Anomaly Action Rule is executed in UBA, it is essential to verify that the system has completed threat revalidation. This ensures that anomalies and threats are correctly updated and reflected in the UBA interface. This article describes how to confirm that the revalidation process has finished.

Investigation

To confirm that the Anomaly Action Rule has executed successfully and Threat revalidation completed ensure the

/var/log/caspida/ruleengine/offlineruleexecutor.log includes "Threat revalidation started" and "Threat revalidation completed".

Resolution

1. Access the UBA management node via SSH as caspida user
2. Search the offlineruleexecutor.log file for the relevant threat revalidation process:
   

   grep "Threat revalidation" /var/log/caspida/ruleengine/offlineruleexecutor.log

3. Confirm that a log entry similar to the following is present, indicating completion:
   

   [caspida@uba-rhel-multi-1 ~]$ grep "Threat revalidation" /var/log/caspida/ruleengine/offlineruleexecutor.log
   2025-12-02 13:36:48,847 INFO AnomalyActionTopic-consumer c.c.r.executor.AbstractRuleExecutor$: Threat revalidation commences as a result of action taken on 4 anomalies
   2025-12-02 13:36:48,858 INFO AnomalyActionTopic-consumer c.c.r.executor.AbstractRuleExecutor$: Threat revalidation: tagged 0 threats associated with the following rules: 19,20,21,5,13,6,14,7,15,16,17,8,10,9,11,18,12 (threat ids: )
   2025-12-02 13:36:49,085 INFO AnomHistoryRuleExecutor-thread-1 c.c.r.executor.AbstractRuleExecutor$: Threat revalidation: untagged 0 threats 
   2025-12-02 13:36:49,359 INFO AnomalyActionTopic-consumer c.c.r.executor.AbstractRuleExecutor$: Threat revalidation completed in 551ms

4. Verify in the UBA UI that threat and anomaly statuses reflect the expected changes post-action.

Related Links

• Splunk UBA Documentation