This section provides information about possible issues when using NetWitness UEBA.
UEBA policy Issue
|Issue||After you create a rule under UEBA policy, duplicate values are displayed in the Statistics drop-down.|
To remove the duplicate values perform the following:
Troubleshoot using Kibana
After you deploy NetWitness UEBA, the connection between the NetWitness Platform and NetWitness UEBA is successful but there are very few or no events in the Investigate > Users tab.
You must identify the missing events and reconfigure the Windows auditing.
|The historical load is complete and the events are coming from Adapter dashboard but no alerts are displayed in the Investigate > Users tab.|
|The historical load is complete but no alerts are displayed in the Investigate > Users tab.|
Troubleshoot using Airflow
|Issue||After you deploy UEBA and if there are no events displayed in the Kibana > Table of content > Adapter dashboard and the Airflow already processed the hours but there are no events. This is due to some communication issue.|
You must check the logs and resolve the issue.