Managing restricted programs

You can manage restricted programs for the IBM® QRadar® User Entity Behavior Analytics (UEBA) app.

About this task

If there are any applications that you want to monitor for usage, go to the UBA : Restricted Program Filenames reference set and enter the applications that you want to monitor. You must then enable the UBA : Restricted Program Filenames rule.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click Reference Set Management.
  3. On the Reference Set Management window, select the UBA : Restricted Program Filenames reference set.
  4. Click View Contents.
  5. To add an application to manage, click Add and enter the values in the box.
  6. To remove an application, select an application and click Delete.

What to do next

Enable the UBA : Restricted Program Filenames rule.