Investigating users in QRadar Advisor with Watson

You can select users from the QRadar® User Behavior Analytics (UBA) app to send to QRadar Advisor with Watson™ for investigation.

Before you begin

  • You must have User Behavior Analytics (UBA) app 3.5.0 or later installed and configured with user data.
  • You must have Admin privileges.
  • You must have QRadar Advisor with Watson 2.5.2 or later.
For more information, see QRadar Advisor with Watson.

Procedure

  1. Click the User Analytics tab to open the UBA Dashboard.
  2. Select a user or search for a user to open the User Details page.
  3. Click the Search Watson icon.
    When the icon stops spinning, the Watson Investigations ID details page opens and you can review your results in the QRadar Advisor with Watson app.