Non-asset monitoring
Non-asset monitoring extends User Entity Behavior Analytics (UEBA) visibility beyond formally registered assets by automatically identifying and monitoring entities that are observed through network activity.
Overview
Previously, UEBA monitored only IP addresses, MAC addresses, and hosts that were associated with the QRadar® Asset Model. Non-asset monitoring extends UEBA visibility beyond formally registered assets, automatically identifying and monitoring entities observed during network activity
Security teams can detect, monitor, and investigate network devices, IP addresses, and hosts that are not in the QRadar Asset Model.
Key benefits
- Automatically discover entities from network activity.
- Monitor devices that are not formally registered as assets.
- Improve visibility into shadow IT and unmanaged systems.
- Expand coverage for risk analysis and anomaly detection.
- Complement imported asset monitoring with automated discovery.
How non-asset monitoring works
UEBA continuously analyzes activity across QRadar data sources to identify entities that appear in the environment.
- Discovery
-
Entities are identified from:
- Events
- Flows
- Offenses
- Other QRadar data sources
- Monitoring
-
Validated entities become available for:
- Risk scoring
- Behavioral analysis
- Anomaly detection
- Entity monitoring workflows
- Synchronization
- UEBA periodically sends heartbeat updates to QRadar to maintain visibility and tracking of discovered entities.
Configuration options
| Setting name | Description |
|---|---|
| Monitor Entities | Primary control for entity monitoring. When enabled, UEBA can monitor imported and discovered entities. |
| Monitor Non-Assets Data | Controls whether automatically discovered entities are monitored. Works only when the Monitor Entities setting is enabled. When enabled, UEBA monitors imported entities and discovered entities. When disabled, UEBA monitors only imported entities. |
