Summary

In this chapter, we have discussed how the UBA app can be installed and configured correctly. Always remember that UBA is a heavy application in terms of computational resources and so we should install App Host first. Additionally, the UBA app is updated regularly with new features, new rules are added, and new searches are introduced. To aid with this, always keep your UBA app up to date.

Also, you should use QRadar NTA along with UBA as it helps get granular information if there is anomalous behavior identified. The risk scores provide guidance on what behavior to look at first. The dashboards for both applications will help you detect as well as mitigate insider threats.

In the next chapter, we will dig deep into how QRadar leverages Watson, IBM’s cognitive engine, to integrate its AI capabilities with the sea of data that QRadar possesses.