Troubleshooting

Document created by RSA Information Design and Development on Sep 11, 2018
Version 1Show Document
  • View in full screen mode

You can use the Kibana and Airflow dashboards to troubleshoot UEBA. Kibana can be used as a SIEM tool.

 

The script that configures NetWitness Platformdata sources that UEBA analyzes maps meta from NetWitness Platform to UEBA as shown in the following tables:

                                                           
UEBA Authentication SchemaNetWitness Meta
eventId event_source_id
dateTimeevent.time
dataSource auth.method
userId user.dst
operationTypelogon.type
resultevent.type
userNameuser.dst
srcMachineIdhost.src

srcMachineName

host.src

dstMachineIdhost.dst

dstMachineName

host.dst

dstMachineDomain-

 

                                                               
UEBA Active Directory SchemaNetWitness Meta
eventIdevent_source_id
dateTimeevent.time
userIduser.dst
operationTypeevent.desc
result event.type
userNameuser.dst
objectIduser.src
operationTypeCategories-

srcMachineId

-

srcMachineName-

dstMachineId

-

dstMachineName-

isUserAdmin

-

 

                                                                       
UEBA File Access SchemaNetWitness Meta
eventId event_source_id
dateTime event.time
userIduser.dst
operationType event.desc
resultevent.type
userNameuser.dst
srcFilePathobj.name contains full path to file (only when obj.type = FILE)
dstFilePath-

isSrcDriveShared

-

isDstDriveShared

-

fileSize

-

srcMachineId

device.ip - needs to be resolved and normalized

srcMachineName

device.ip - needs to be resolved and normalized

dstMachineId -

dstMachineName

-

 

                                                                         
UEBANetWitness Meta KeyMeta Key Description
srcFilePath filenameDocument/File name
userNameuser.dstAccount name
-ip.dstport Destination port
- ip.dst Destination address

-

protocol IP protocol name
srcMachineNamehost.srcSource host name
- bytes.srcBytes sent
- rbytesBytes received

fileSize

filename.size

Size of the Document/File name

srcMachineDomain domainDomain name

dstMachineName

host.dst

Destination host name

dstMachineDomain ddomainDestination domain
You are here
Table of Contents > Troubleshooting

Attachments

    Outcomes