Dormant accounts

You can see users in your system that have dormant accounts, active accounts, or accounts that have never been used.

Viewing dormant accounts on the User Details page

You can see the status of the accounts that are associated with the selected user on the User Details page.

User Account Status	Description
Active	An account that UBA has seen events from a QRadar® log source within the configured dormant account threshold time period.
Dormant	An account that UBA has seen at least one event from in the past but has not seen any new events during the dormant account threshold time period.
Never Used	An account for which UBA has never seen an event with that user name in a QRadar log source. Accounts identified as "Never Used" can be caused by the following activities: Accounts that have never been logged by a QRadar log source for the associated user name account. The event occurred before UBA 3.2.0 was installed. Note: When you first install the UBA app, only events that occurred in the last hour are analyzed to determine when an account was last accessed. After the initial analysis, the UBA app queries events that occurred between executions of the background task that watches for account usage. Note: Accounts that are categorized as "Never Used" were likely imported from the LDAP app.

Users with Dormant Accounts watchlist

The Users with Dormant Accounts watchlist is automatically generated as the UBA app pulls in user data. You can view the Users with Dormant Accounts watchlist on the UBA Dashboard.

If you delete the watchlist, it is not automatically re-created. If you need to create it again, select the UBA : Dormant Accounts reference set on the Membership Settings tab on the Create a watchlist screen.

Configuring the dormant accounts threshold

The default value for the dormant accounts threshold is 14 days. You can change the number of days that users are inactive before they are considered dormant in the Application Settings section on the UBA Settings page (Admin Settings > User Analytics > UBA Settings).

Responses to dormant accounts or users

You can generate responses for dormant accounts from the provided rules. You can also create custom responses by using the events that are triggered from the app.

To use the provided rules so that a user's score is increased when an account that was dormant is used or is attempted to be used, make sure that the following rules are enabled:

To create custom responses, you can use the following generated events in a rule or query:

Dormant Account Found (QID 104000012)
Dormant Account Used (QID 104000013)