Setting up QRadar UBA

As we know why we need UBA in our environment, let us look at the steps that need to be taken to set up UBA. The first step would be to install UBA. It is important to know the computational resource requirements of UBA. UBA, when installed with ML, needs a lot more resources than when deployed without ML model, and hence you should always use QRadar App Host.

In the official docs, there's more information on how to install the Machine Learning Analytics app: https://www.ibm.com/docs/en/qradar-common?topic=app-machine-learning-analytics

Once installed, we will need to import user information into UBA. Both topics, installing UBA and importing user information, are discussed in detail next.

Installing QRadar UBA

QRadar UBA, as mentioned earlier, is a QRadar app. The app is available from the QRadar App Exchange portal, which is publicly available at https://exchange.xforce.ibmcloud.com/hub. The UBA app is available as a ZIP file that can be downloaded...