UBA application tuning
The UBA app, along with the ML app,needs a lot of tuning as per your environment. We have seen that the UBA application has so many configuration parameters. We have already mentioned that if you plan to use UBA, you should install App Host as UBA is a computationally heavy app. The number of resources made available to the UBA and ML apps may limit the number of users that can be monitored. If the number of users becomes high, UBA will require more computational resources, which will in turn hamper performance as the UBA app’s graphical interface can become slow or unresponsive.
Some basic tuning tips for the UBA and ML apps are as follows:
- Import users using a directory server/LDAP/CSV file
We have seen that there are many ways in which users are added. In Figure 8.2, we saw a few users were discovered using event data such as events and flows. For most of these users, the event data has users such as admin and root that cannot be correlated...
