splunk has been a valuable and intuitive tool for analyzing user behavior data. clear dashboards overall.

We actually went a different route at our organization. While we evaluated the Splunk UBA offering a couple of times we ultimately built what we call "UBA Lite". Our primary challenge was that to really leverage the power of Splunk UBA we needed data sources that we didn't have or would be challenging to accurately maintain. A primary data source for Splunk UBA is a proxy and while we may have been able to feed the product something helpful we don't have proxies deployed in a fashion that would have worked the best. With more people now remote and not passing through a traditional proxy, this data source becomes less valuable. We did decide to review Splunk ESCUs to and selected a number of UBA use-cases that we built out for ourselves based on data that we had readily available. This allowed us to be more focused on our specific requirements without having to add less valuable data sources and also provided us some cost savings.