Understanding the QRadar NTA app
We have discussed UBA and understand that it works on different kinds of events that are received in QRadar. But what about flows? Does QRadar use flows to detect anomalies in behavior? Yes, it does. And for that, we have a QRadar app called QRadar NTA. You may install this app from the IBM X-Force App Exchange portal, and it is free of charge.
After installing QRadar NTA, the app trains itself by analyzing the flows already available and creates a baseline of what kind of traffic is received. NTA uses ML algorithms to understand and generate a baseline. The following screenshot shows the configuration settings required for NTA:
Figure 8.4 – Configuration parameters for the NTA app
In the preceding screenshot, we can see the authorized token that will be generated on QRadar, and then you may copy and paste it into the app.
Default timeframe is the amount of time for which the NTA app analyzes the flow data...
