How does QRadar UBA work?
As mentioned earlier, before installing the UBA app, there is the prerequisite that a DSM named IBM Sense is installed on QRadar. We learned what DSMs are in Chapters 4 and 5. To reiterate, DSMs are device support modules installed on QRadar, so that QRadar parses incoming data in a consumable format.
When the UBA app is installed, UBA rules are also added. These UBA rules look for certain event data, and if it is found, a sense event is triggered. This sense event is then consumed by the UBA app. The sense event will have a certain risk value as well as a username associated with it. When UBA consumes this sense event, it in turn increases the risk value of the user. Risk scores are stored in the QRadar PostgreSQL database.
The IBM Sense DSM is used to parse the sense event in this case. Once the Sense DSM parses the event, the event is evaluated against all the rules in QRadar, including the just-added UBA rules too. If the event matches the rule conditions...
