Installing and configuring Machine Learning in Multitenancy

With 3.6.0 and later, you can install and configure Machine Learning to work in a multitenant environment in QRadar® 7.4.3 Fix Pack 6 and later.

Before you begin

You must complete the steps outlined in the table on the QRadar configurations for setting up multitenancy in UBA page on a system with QRadar 7.4.3 Fix Pack 6 and later.

Before attempting to install and configure any Machine Learning instance be sure you have an Admin instance of UBA installed by completing the following steps Installing the User Behavior Analytics app.
Attention: Do not install Machine Learning (ML app) on the Admin or shared instance.

About this task

The following procedure must be completed by the QRadar Admin or the MSSP admin.

Important: For QRadar version 7.4.3, the container size and the amount of memory you select for the first Machine Learning instance that you configure will apply to all tenant instances. To change the container size, you would need to remove all running Machine Learningg instances and install again to be able to configure a different container size. For QRadar 7.5.0, the first Machine Learning instance created will become the lowest available container size allowed for additional tenants. Additional tenants will be allowed to specify a container size greater than the first Machine Learning instance.

Procedure

  1. Find the User Behavior Analytics extension in the IBM QRadar Assistant app.
  2. Select the UBA instance that you want to install Machine Learning on.
  3. Select Option > Configure Instance > Machine Learning Settings.
  4. Configure the appropriate size for the Machine Learning instance.
    Important:
    • QRadar 7.4.3: The size of the Machine Learning instance must be the same for every instance when using QRadar 7.4.3. For example, if instance A uses a 5 GB Machine Learning instance, instances B and C must either use no Machine Learning or 5 GB.
    • QRadar 7.5.0: For QRadar 7.5.0 each tenant is allowed to be equal or greater than the size of the initial Machine Learning instance. For example, if instance A uses 5 GB, then instance B and C may install 5 GB or larger, but are not permitted to install at 2 GB size.
  5. Select Install ML App.
    The instance is now ready for the tenant admin and tenant users to access.

What to do next

Repeat these steps for instances of UBA that you want to install Machine Learning on.