Monitor Health and Wellness of UEBA
You can view the status of UEBA host in the Users > OVERVIEW tab.
The UEBA system should generate at least one alert weekly. If the system stops generating the alerts for a period of seven days or more, advanced monitoring is required to monitor statistics about the total number of events versus successful events, total number of alerts generated, and so on.
Advanced monitoring is enabled through a third-party tools prepackaged in NetWitness: Kibana and Airflow.
Access KibanaAccess Kibana
To access kibana, go to https://<UEBA_host>/kibana/app/kibana#/, enter user name and password and the Dashboard is displayed.
Access Airflow
To access Airflow, go to https://<UEBA_host>/admin/, enter user name and password and the DAGs view is displayed.
Note: The Kibana and Airflow web server user interface password is the same as the deploy_admin password. Make sure that you record this password and store it in a safe location.
Kibana
Kibana is an open source analytics and visualization platform. You can monitor the health of UEBA through various dashboards:
Overview Dashboard
The Overview dashboard provides the statistics over the analytics about the users, entities, alerts, and indicators, such as:
- The alerts type that are generated, and the alert severity distribution with the severity types (Low, Medium, High, Critical).
- Total number of active entities and how many alerts are generated for those entities.
- The number of indicators and events processed.
- The pie chart for entity score severity and distribution for the alerts classification.
- Alert daily histogram, which is the total number of alert per each severity triggered over time.
Configure Select Entity Type drop-down Filter
You can view the data for a specific entity after configuring and applying the Select Entity Type drop-down filter in Kibana Dashboard > Overview.
To configure Select Entity Type drop-down Filter:
-
Remove Invalid visualization type "dropdownpicker" panel. Do the following.
-
Go to Kibana, click Dashboards > Overview.
-
Click Edit and then click on the Invalid visualization type "dropdownpicker" panel.
-
Click More > Delete from dashboard > Save.
-
-
Go to Kibana, click Dashboards > Alerts & Indicators Status.
The Alerts & Indicators Status dashboard is displayed.
-
Click Edit > All types > Controls > Options List > .
-
Enter Select Entity Type in the Control Label field.
-
Select presidio-output-entity option in the Index Pattern field.
-
Select entityType from the Field drop-down list.
-
Click Update.
-
Click Save and return.
-
The newly configured Select Entity Type drop-down panel is displayed at the bottom of the Dashboard > Editing Alerts and Indicators Status view. Drag and drop the panel to the top of the page. You can also maximize the panel.
-
Click Save.
-
Click Switch to view mode.
To access the overview dashboard:
- Go to Kibana, click Dashboards > Overview.
The Overview dashboard is displayed with the aggregate results for all entities.
- To view the data for a specific entity, select a value from the Select Entity Type drop-down. For example, ja3, sslSubject, or userid.
- Adjust the time range on the top-right corner of the page based on your requirement to view the statistics.
System Host overview
The System Host overview dashboard monitors the performance and health of UEBA hosts, such as:
- CPU usage.
- Memory consumption, and network.
- Process consuming CPU and Memory, for example MongoDB.
- Statistics over the disk usage.
-
Inbound data is the amount of data transferred by user to view the UEBA UI.
-
Outbound data is the amount of data fetched by UEBA from Broker or Concentrator.
To access System Host overview dashboard
- Go to Kibana, click Dashboards > System host overview.
The System host overview dashboard is displayed.
- Adjust the time range on the top-right corner of the page based on your requirement to view the statistics.
Note: During historical load, the system works in high parallelism. Due to that IO, CPU, and Memory is in high utilization. The pace would be 30 logical days four wall clock time. Once the UEBA server is online, the resource utilization reduces.
Adapter Dashboard
The Adapter dashboard is used to monitor the following:
- The failed events distribution.
- Total number of events versus successful events.
- Saved events per schema.
To access the entities, alerts and indicators:
- Go to Kibana, click Dashboards > Entities,alerts,indicators.
The Entities,alerts,indicators Dashboard is displayed with an aggregate data for all entities. - To view the data for a specific entity, select a value from the Select Entity Type drop-down. For example, ja3, sslSubject, or userid.
To access the adapter dashboard system Time:
- Go to Kibana, click Dashboards > Adapter.
The Adapter Dashboard is displayed.
- Adjust the time range on the top-right corner of the page based on your requirement to view the statistics.
Support Dashboard Logical Time
The Support Dashboard Logical Time provides the capability to detect events processed time, which is different from the system time, such as:
- The amount of filtered events over time per schema
- The total number of alerts generated
- The alert types distribution
- The events that are related to an alert
To access support dashboard logical time:
- Go to Kibana, click Dashboards > Support Dashboard logical time.
The Support Dashboard logical time is displayed.
- Adjust the time range on the top-right corner of the page based on your requirement to view the statistics.
Support Dashboard System TimeSupport Dashboard System Time
The support dashboard system time allows you to monitor the system time when events are processed.
- The amount of filtered events over time per schema.
- The total number of alerts generated.
- The alert types distribution.
- The events that are related to an alert.
To access support dashboard system Time:
- Go to Kibana, click Dashboards > Support Dashboard system Time.
- Adjust the time range on the top-right corner of the page to view the statistics.
Scoring and Model Cache
The Scoring and Model cache dashboard provides the capability to view events being scored.
To access scoring and model cache dashboard:
- Go to Kibana, click Dashboards > Scoring and model Cache.
The Scoring and model cache dashboard is displayed.
- Adjust the time range on the top-right corner of the page to view the statistics.
Airflow
Airflow is a tool for describing, executing, and monitoring the UEBA tasks. In Airflow, a DAG is a collection of all tasks you want to run, organized based on the schemas that reflects their relationships and dependencies. For example, schemas such as Active Directory, Authentication, File, Process, TLS and Registry. Each schema is divided into two:
- Indicator DAG which is responsible to read events from broker and score the events based on the models.
- Model DAG which is responsible in building the models.
You can monitor the scheduled task by seeing how many tasks are successful, failed, or currently running.
There are several DAGs and each DAG is a workflow.
To monitor UEBA service tasks, perform the following:
- Go to Airflow.
The DAGs view is displayed. - In the DAG Runs section, see the status of the tasks. For example, how many tasks are successful, failed or currently running.
- To view the different tasks associated with the DAG, click Tree view.
The Tree view of the DAG is displayed. - To view the DAG’s dependencies and the current status of a specific task, in the DAG, click Graph view.
In the Graph view, hover over the task to see the status of the specific task.
For detailed information about the specific task, click Task and click Task Instance Details.
The Task Instance Details view is displayed.
To view the logs of the specific task, click Log.
Note: After you begin to run a DAG, schemas cannot be removed from UEBA, otherwise the process will stop. For more information see, 'Troubleshooting UEBA Configurations' topic in the UEBA Configuration Guide..