What is UBA?

Many security vendors provide similar security solutions, called User and Entity Behavior Analytics (UEBA). Other vendors, apart from IBM, have the solution as a separate product. But IBM has designed UBA to provide seamless integration with the information already available in terms of event data that we have in QRadar. The integration is tighter than the standalone UEBA solution, providing better results in a shorter period. As QRadar has also introduced App Host as a separate managed host where apps can be installed, the number of computational resources provided to UBA can be drastically increased.

UBA and ML form the backbone of QRadar when it comes to insider threats. These are security products in themselves that are seamlessly integrated into QRadar. There are other vendors that provide UBA as separate products. But adding UBA as an app in QRadar has multiple advantages, including ease of use.

The ML models used in QRadar for UBA help to drastically reduce...