Feature spotlights

Detects insider threats based on user behavioral anomalies

User behavior analysis and fine-grained machine learning algorithms can detect when users deviate from normal activity patterns or behave differently from their peers. QRadar UBA creates a baseline of normal activity and detects significant deviations to expose both malicious insiders and users whose credentials have been compromised by cyber criminals.

Integrate seamlessly with IBM QRadar

QRadar UBA integrates directly into the QRadar Security Intelligence Platform, leveraging the existing QRadar user interface and database. All enterprise-wide security data can remain in one central location, and analysts can tune rules, generate reports and integrate with complementary Identity and Access Management (IAM) solutions – all without having to learn a new system or build a new integration.

Generates detailed risk scores for individual users

Risk scores dynamically change based on user activity, and high-risk users can be added to a watch list. Security analysts can easily drill down to view the actions, offenses, logs and flow data that contributed to a person’s risk score. This helps shorten the investigation and response times associated with insider threats.

Available from the IBM Security App Exchange

QRadar UBA is packaged as a downloadable app that is independent of the platform’s formal release cycles. All current QRadar clients can add this app to QRadar version 7.2.8 or higher to begin seeing a user-centric view of activity within their networks.

Get the SDK

IDC Lab Validation Brief: IBM QRadar with UBA

Read the analyst report

Customer case study

Case study image

With cybersecurity a national mandate, the people get a first line of defense

ATEA Sverige AB
Read the case study

How customers use it

  • Gain visibility into insider threats

    Problem

    Detecting cyberattacks, prioritizing security incidents, and effectively responding to insider threats.

    Solution

    Uncover anomalous behaviors to more quickly and effectively identify rogue insiders and cyber criminals using compromised credentials.

  • Extend QRadar platform capabilities

    Problem

    Monitoring potentially malicious activity for individual users is manual and requires many disconnected tools.

    Solution

    The UBA dashboard is an integrated part of the QRadar console and helps extend existing capabilities to better identify high-risk users. Investigate any user's anomalous behavior from the individual user details page of the UBA app.

  • Monitor user risk across the enterprise

    Problem

    Determining the overall health of your environment and the risks that user pose in it.

    Solution

    Apply machine learning to generate users’ risk scores, identify high-risk users and only raise alerts on the riskiest activities to provide early warning of a threat without overwhelming analysts.

Technical details

Software requirements

All current QRadar clients can add this app to their QRadar version 7.2.8 or higher releases to begin seeing a user-centric view of what is happening within their networks. For the best experience, upgrade your QRadar system to QRadar 7.2.8 Patch 13 (or later) or QRadar 7.3.1 Patch 6 (or later). Supported browsers:

  • Mozilla Firefox 45.2 Extended Support Release
  • Google Chrome (Latest)

Hardware requirements

The QRadar console limits the amount of memory that can be used by apps. The minimum amount of free memory required to install the Machine Learning app is 2 GB, however 5 GB or higher is recommended. The number of users monitored depends on the ML app installation size and the specific Machine Learning analytic.

  • The UBA app requires 1.2 GB of free memory from the application pool of memory.
  • The maximum number of monitored users by any ML model is 40,000 per 5 GB up to 160,000 users total.

You may also be interested in

Explore these related products in the QRadar family:

IBM QRadar SIEM

Protects assets and information from threats using contextual insights

Learn more

IBM QRadar Advisor with Watson

Applies AI to investigate IOCs and provide context into threats.

Learn more

IBM QRadar Network Insights

Inspects network traffic in real-time to expose hidden threats.

Learn more

IBM QRadar on Cloud

Provides a SaaS version of QRadar SIEM, hosted in the IBM Cloud.

Learn more
See more products in this family

See how it works

Try the online tool

Learn more

Download now

Expert resources to help you succeed

Community

Get technical tips and insights from others who use this product.

Product documentation

Find answers quickly in IBM product documentation.

Support

Learn more about product support options.