Importing entities

Entity import enables administrators to import entity information into IBM® QRadar® User Entity Behavior Analytics (UEBA) from external sources such as CSV files and QRadar reference tables.

Overview

Organizations can use entity imports to onboard and monitor selected entities within their environment. UEBA supports the following import sources:

  • CSV files
  • QRadar reference tables
Important: Imported entities are not monitored automatically. You must enable entity monitoring to include imported entities in UEBA monitoring and analytics.

Enabling entity monitoring

To include imported entities in UEBA monitoring and analytics, complete the following steps:

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. Enable Entity Monitoring.
  3. Click Save.

After you enable entity monitoring, imported entities become available for monitoring, behavioral analysis, and risk evaluation.

Advantages

Entity import helps organizations:

  • Focus entity monitoring on specific entities
  • Import entity data from multiple sources
  • Synchronize entity data with QRadar reference tables