uberAgent ESA ES Companion
Splunk introduced risk-based alerting (RBA) in Enterprise Security (ES) to reduce alert volume and enhance security operations. uberAgent supports RBA through the uberAgent ESA ES companion app. See the documentation for installation instructions. When all requirements are met, the Splunk Enterprise Security dashboard Risk Analysis is populated automatically with uberAgent data.