I know a long time ago we asked the same question and the answer was then " we are working on that" but the latest version of iba is still not domain aware since we are running a multi domain setup its basicly making UBA useless.

• All reference sets are being filled as " shared data" instead of domain specific etc so a user event from one domain is adding to the risk score for a user in another domain

• Learned peers have overlap with users from other domains

With all the work that has gone in underneath in Qradar it feels like the developpers of UBA are missing / arent using a lot of that functionality.

------------------------------
Martijn Groenewegen
------------------------------

I agree, it does seem like we have been waiting a long time for this.

From what I have been led to believe this will require a 7.4 type update and thus being able to passing this information via the API. This behind the scenes change will lead UBA being domain aware almost upon release.

7.4 is not expected until next year.

------------------------------
James Hill
------------------------------

AFAIK the QRadar 7.4 release will come next year (target is Q1-2020) with an update of the App Framework to provide full multi-tenancy support. Apps will then need to be updated to fully support the multi-tenancy, but the UBA dev team is already working on such an update that will be released shortly upon the 7.4 GA. My2cs.

------------------------------
Jean-Luc Labbe
Cognitive Security Intelligence, Europe
IBM Security
------------------------------

Original Message:
Sent: Mon November 04, 2019 03:40 AM
From: James Hill
Subject: Qradar UBA , domain aware / multi-tenant

I agree, it does seem like we have been waiting a long time for this.

From what I have been led to believe this will require a 7.4 type update and thus being able to passing this information via the API. This behind the scenes change will lead UBA being domain aware almost upon release.

7.4 is not expected until next year.

------------------------------
James Hill
------------------------------

Martijn:

The current target date for the multi-tenant apps on QRadar (including UBA) is late in Q1 of 2020.  That ofcourse is based on executing the current plan and not running into any major technical hurdles.  As far as I know the development and testing of the multi-tenant app frame is on track till now.  We need that to enable the apps to be multi-tenant on QRadar.  

Hope it helps and thanks you for your usage, feedback and requirements for UBA.

thanks

Milan

------------------------------
PATEL MILAN
IBM
------------------------------