IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  UBA multi-tenant, LDAP too?

    Posted Fri May 15, 2020 03:38 PM
    Hi,

    We were waiting a long time for UBA to become multi-tenant, some of our customers want to use it asap.
    We are planning to upgrade to 7.4.0 soon. In preparation to this we followed the feature discussion yesterday via webinar but they didn't have an immediate answer to our question.

    Does the multi-tenant UBA also supports LDAP for different tenants?

    ------------------------------
    Mathias Claeys
    System Engineer
    ------------------------------


  • 2.  RE: UBA multi-tenant, LDAP too?

    Posted Mon May 18, 2020 01:45 AM
    Hey Mathias,

    You should read the below.
    https://exchange.xforce.ibmcloud.com/hub/extension/IBMQRadar:UserBehaviorAnalytics

    Version 3.6.0
    -Added support for QRadar multitenancy.

    T&R
    Arjun

    ------------------------------
    Arjun Kumar Network & Security Engineer
    ------------------------------

    Original Message


  • 3.  RE: UBA multi-tenant, LDAP too?

    Posted Mon May 18, 2020 01:50 AM
    Hi Arjun,

    We are aware that UBA is multi-tenant now since the last update. It's an update we were waiting a long time for.
    The question was if separate tenants will now also be able to all link LDAP(s) connections. Currently that's not possible to have that split by tenant.

    Kind regards,
    Mathias

    ------------------------------
    Mathias Claeys
    System Engineer
    Cegeka
    ------------------------------

    Original Message


  • 4.  RE: UBA multi-tenant, LDAP too?

    Posted Mon May 18, 2020 11:49 AM
    From v. 3.6.0 in it you should fins also the User import wizard which allows to import user data directly from the UBA app. I would imagine that this part would behave as the rest of the application  in case of multitenancy (multi-instance) use.
    In the section related to UBA multitenancy in the knowledge center there's a note refering to that:  "You should not use the LDAP app in a multitenant environment because the LDAP app is not multi-domain or multitenant aware so any user will see any import".
    There should be a designated UBA tenant admin who's responsible to configure user imports.

    ------------------------------
    Dusan VIDOVIC
    ------------------------------

    Original Message


  • 5.  RE: UBA multi-tenant, LDAP too?

    Posted Tue May 19, 2020 03:01 AM
    Thank you!
    Reference Data Import - LDAP app

You should not use the LDAP app in a multitenant environment because the LDAP app is not multi-domain or multitenant aware so any user will see any import.
​

    This was indeed the sentence I was looking for. We hope they update this in the near future to be possible, but we can inform our customers correctly now.



    ------------------------------
    Mathias Claeys
    System Engineer
    Cegeka
    ------------------------------

    Original Message