Importing and coalescing identities is a breeze with IBM QRadar UBA!
The LDAP app in UBA provides a utility that guides admins through a 4 step process to import and merge identities of users for User Behavior Analytics.
Admins should export the identity and user data from the repository like IAM, HR, Proxy, Web, VPN directories into a flat csv file.
Then using the csv import feature of the LDAP app to import and coalesce identities in 4 easy steps.
Step 1: Select the csf file for the identity data that you want to import into UBA Users reference map.
Figure 1: Import User Identities
Now, click on Next.
Step 2: Select the option to merge into an existing reference table. Figure 2.
Figure 2: Option to create new or merge with an existing reference table
Step 3: Select an existing [Identity] reference table that you want to update with the additional identity and user information. Figure 3.
The app will automatically match the data fields in the imported file to the reference table to recommend the primary fields that can serve as primary matching key. Click on Next.
Figure 3: Select a reference table
Figure 4: Option to create new or merge with an existing reference table
Step 4: Select the recommended and/or any other fields that you want to use as primary key to merge the imported user identity data. The app will gray out all the fields that it detects have non-unique values to each user, thereby disabling potential corruption of the identity data of users.
Figure 5: Start the import process
Click Import (Figure 5) and the app will import and coalesce all the additional information about users from the new source.
Iterate through this process for each of the Identity directory that you want to import.
#QRadar#QRadarUBA