IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Coalescing two account names or Samaccountnames

  • 1.  Coalescing two account names or Samaccountnames

    Posted Wed March 31, 2021 02:44 PM

    I would like to combine two Samaccountnames into a single user for uba timeline events.

    my example is a normal user account and the admin account. These two accounts are for the same user in the same domain but two separate AD user accounts. Is this possible with coalescing or a manual add?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Coalescing two account names or Samaccountnames

    Posted Wed April 21, 2021 08:59 PM

    Yes, you can manually create a csv file with the field names as the header and the unique name from both accounts as comma separated values. You can then take the csv and import it into UBA. After coalescing is ran those two users should be grouped into one.



    #QRadar
    #Support
    #SupportMigration