IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  UBA Installation

    Posted Sun January 19, 2020 11:47 PM

    Hi
    I've brought a log license on Qradar.
    I'm interested in UBA so I download and try to install but there's no UBA tab shown on my dashboard.

    I'm wondered that UBA is required threat management license? If not what I'm wrong.
    Please suggest me 

    Thanks!



    ------------------------------
    MAC Strater
    ------------------------------


  • 2.  RE: UBA Installation

    Posted Mon January 20, 2020 07:12 AM
      |   view attached
    ​Hi,

    Suggestions are to check that UBA (the docker container it is in) successfully installed. This can be done by checking the docker instance for UBA is running on the command line (as root). If you can't see the app instance ID (usually a four digit number) in the docker ps command, then check the qradar logs in /var/log

    If it didn't install or there are errors in the log/s, then resolve that first.

    If it did, then it should be under the admin LH side menu. It may not be selected to show on the tabs (if the start star is not blue). I have also seen the tab fail to appear if the install had problems (and also other apps like experience center when tight on the memory pool).

    Some bits here: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.UBAapp.doc/t_Qapps_UBA_install.html

    Note the pre-requisites on host capacity as it is greedy on resources.

    Lastly, consider using your support contract (if you have one).

    HTH,

    Darren

    ------------------------------
    Darren H.
    ------------------------------

    Original Message