UEBA : User Potentially Phished

The QRadar® User Entity Behavior Analytics (UEBA) app supports use cases based on rules for certain behavioral anomalies.

Enabled by default

False

Default senseValue

Default senseValueSource

Description

Detects 3 or more instances of potential phishing attacks on a single user within an hour. Note: Edit the supported building block to monitor any rules that are appropriate for the environment.

Support rules

BB:UBA : Compromised Account - Initial Access

UBA : Browsed to Malicious Website
UBA : Browsed to Phishing Website
UBA : Browsed to Scam/Questionable/Illegal Website
UBA : User Accessing Risky IP, Botnet
UBA : User Accessing Risky IP, Malware

Required configuration

See supported rules

Log source types

See supported rules