IBM Security QRadar

 View Only

  • 1.  Qradar UBA , domain aware / multi-tenant

    Posted Sat November 02, 2019 02:50 AM

    I know a long time ago we asked the same question and the answer was then " we are working on that" but the latest version of iba is still not domain aware since we are running a multi domain setup its basicly making UBA useless.

    • All reference sets are being filled as " shared data" instead of domain specific etc so a user event from one domain is adding to the risk score for a user in another domain

    • Learned peers have overlap with users from other domains

    With all the work that has gone in underneath in Qradar it feels like the developpers of UBA are missing / arent using a lot of that functionality.



    ------------------------------
    Martijn Groenewegen
    ------------------------------


  • 2.  RE: Qradar UBA , domain aware / multi-tenant

    Posted Mon November 04, 2019 03:41 AM
    I agree, it does seem like we have been waiting a long time for this.

    From what I have been led to believe this will require a 7.4 type update and thus being able to passing this information via the API. This behind the scenes change will lead UBA being domain aware almost upon release.

    7.4 is not expected until next year.

    ------------------------------
    James Hill
    ------------------------------

    Original Message


  • 3.  RE: Qradar UBA , domain aware / multi-tenant

    Posted Mon November 04, 2019 04:23 AM
    Edited by Jean-Luc Labbe Mon November 04, 2019 04:23 AM

    AFAIK the QRadar 7.4 release will come next year (target is Q1-2020) with an update of the App Framework to provide full multi-tenancy support. Apps will then need to be updated to fully support the multi-tenancy, but the UBA dev team is already working on such an update that will be released shortly upon the 7.4 GA. My2cs.



    ------------------------------
    Jean-Luc Labbe
    Cognitive Security Intelligence, Europe
    IBM Security
    ------------------------------

    Original Message


  • 4.  RE: Qradar UBA , domain aware / multi-tenant

    Posted Mon November 04, 2019 10:19 AM
    Martijn:

    The current target date for the multi-tenant apps on QRadar (including UBA) is late in Q1 of 2020.  That ofcourse is based on executing the current plan and not running into any major technical hurdles.  As far as I know the development and testing of the multi-tenant app frame is on track till now.  We need that to enable the apps to be multi-tenant on QRadar.  

    Hope it helps and thanks you for your usage, feedback and requirements for UBA.

    thanks

    Milan

    ------------------------------
    PATEL MILAN
    IBM
    ------------------------------

    Original Message