IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Clicking on View User Details does nothing on Offenses page

    Posted Mon July 10, 2023 11:41 AM

    Hello,

    I recently installed the UBA and I thought you could pivot to a user's details by right clicking on the name.  However, nothing happens when I try this.  View Assets and View Event both open a new window.  Tried both on Edge and Firefox.

    My instances are 7.5.0 UpdatePackage 6 (Build 20230519190832) and User Analytics 4.1.12.  Thanks!



    ------------------------------
    Tom L
    ------------------------------


  • 2.  RE: Clicking on View User Details does nothing on Offenses page

    Posted Tue July 11, 2023 08:10 AM

    Tom

    no idea where you actually come from. Can you pls explain in some more detail? Your screenshot shows a standard Log Activity search or the result of an AQL search, where you use the context menu for more information. More options will give you the options you listed when you are grouping by e.g. username. View userdetails will get you to the details of the username in UBA 4.1.12. as expected. Only difference I can see is Update Package 6 we dont use yet. I used Chrome for testing as we experienced some Firefox issues recently. Edge is not in use.

    Your search shown in your screenshot however summarizes fields in some specific way so my guess is its maybe something special made? Maybe I missed something?

    Best Regards

    Karl



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------

    Original Message


  • 3.  RE: Clicking on View User Details does nothing on Offenses page

    Posted Tue July 11, 2023 10:05 AM

    moreover on this one. When your username does exist in UBA it will be shown. If not UBA wont open at all. You can verify that behaviour by searching for the correspondent user in UBA directly. If it is not found no context wndow will open. Works as designed as development says. ER: pls show user not found message like when searching in UBA directly.



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------

    Original Message


  • 4.  RE: Clicking on View User Details does nothing on Offenses page

    Posted Tue July 11, 2023 12:32 PM

    Thanks @Karl Jaeger 
    The usernames I was searching for were not active in UBA.  I cleaned up my LDAP filter in the UBA user import and now it works as expected (in Microsoft Edge as well).



    ------------------------------
    Tom L
    ------------------------------

    Original Message


Related Content