IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  UBA Multi Tenancy configuration

    Posted Mon May 11, 2020 10:40 AM

    Hi everyone,

    From some reason the UBA feature is not working properly in my system.  We probably misses something along the way.. 

    Can you provide me with a step by step process for configuring multi tenancy for UBA feature?

    Thank you in advance!!



    ------------------------------
    Katia
    ------------------------------


  • 2.  RE: UBA Multi Tenancy configuration

    Posted Mon May 11, 2020 04:28 PM
    Hi Katia, some recomendations I would suggest

    a) Review the documentation of UBA: https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.UBAapp.doc/c_Qapps_UBA_intro.html

    b) Within the documentation chechk the Multitenancy part
    https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.UBAapp.doc/c_Qapps_UBA_multitenancy.html

    c) Install the latest QRadar Assistant app (includes new options to manage applications within the Web console)

    d) Remember that for UBA to be multitenant you need QRadar 7.4

    I hope that info could provide a initial guide

    Regards

    ------------------------------
    Juan Paulo
    IBM
    Santiago
    ------------------------------

    Original Message


  • 3.  RE: UBA Multi Tenancy configuration

    Posted Tue May 12, 2020 01:14 AM

    Thanks Juan, already did the suggested few times.

    For some reason the Dormant Acccount rule was on. We turned it off and deleted the Dormant Account Reference Set (as both our Admin and tenant instances were pulling from this list) before reinstalling the UBA application.

    For now it looks good.. 



    ------------------------------
    Katia Sharabi
    ------------------------------

    Original Message


Related Content