IBM Security QRadar

 View Only
  • 1.  Can i use UBA feature with Log Management license ?

    Posted Mon July 08, 2019 03:41 AM
    Can i use UBA feature with Log Management license ?

    ------------------------------
    Priyavit Aukawongsaree
    ------------------------------


  • 2.  RE: Can i use UBA feature with Log Management license ?

    Posted Mon July 08, 2019 06:49 AM

    Hi,

    Could you please elaborate your question?

    As per my understanding,

    UBA is an app the works on the collected events and quickly determine the risk profiles of users inside your network and to take action when the app alerts you to threatening behavior.

    And log management license gives you the number allowable events per second, whatever app you use (like service now, bigfix, UBA etc), license limit will not increase or decrease. License limit will remain the same.

    So in short you can you UBA feature with log management license.


    Regards
    Asif Siddiqui



    ------------------------------
    Asif Siddiqui
    ------------------------------



  • 3.  RE: Can i use UBA feature with Log Management license ?

    Posted Tue July 09, 2019 09:23 AM
    The app exchange for QRadar is for the SIEM not Log Manager licensing. The good news is you can upgrade from Log Manager to SIEM easily by purchasing the license key.

    ------------------------------
    Richard Gingras
    QRadar SME
    IBM Security
    Cambridge MA
    ------------------------------



  • 4.  RE: Can i use UBA feature with Log Management license ?

    Posted Wed July 10, 2019 12:20 PM
    Edited by Jeremy Goldstein Wed July 10, 2019 01:00 PM
    Hi @Priyavit Aukawongsaree,

    From speaking to some folks, I don't think it's recommended. It may work for some parts of UBA, but not for others as it is designed to sit on QRadar SIEM vs. Log Manager. I'm double checking with the UBA offering manager and dev teams to see if they have any additional insight and will reply when I have an answer for you.

    Best,
    Jeremy

    ------------------------------
    Jeremy Goldstein
    ------------------------------



  • 5.  RE: Can i use UBA feature with Log Management license ?

    Posted Wed July 10, 2019 01:00 PM
    Hi @Priyavit Aukawongsaree,

    As it turns out, while you could install and run it, but it wouldn't fill with any data as most of UBA is rule and offense based and log manager doesn't have that right​.

    Best,
    Jeremy

    ------------------------------
    Jeremy Goldstein
    Product Marketing Manager
    IBM QRadar
    ------------------------------