UBA overview and user details

The IBM® QRadar® User Behavior Analytics (UBA) app shows you the overall risk data for users in your network.

Overview page

After you install and configure the UBA app, open the UBA Overview (Dashboard) page.

Note: The supported number of users that the UBA app can monitor is 400,000 users.

In the Viewing: All users field, you can create and select views to customize your dashboard view. For more information, see Managing the UBA dashboard views.

In the Search for User field, you can search for users by name, email address, user name. As you enter a name, the app shows you the top five results.

The Tenant label shows the domain name of the current tenant being viewed.

The risk level for each user is indicated by an icon. The yellow square icon (low) shows when risk is 25% or less of the risk threshold. The orange diamond (medium) shows when risk is at 50% of the risk threshold. The red pyramid (high) shows when risk is at 75%. The red triangle (critical) shows when risk is at 100% or more.

The dashboard is automatically refreshed every minute and shows you the following risk data:

Table 1. UBA dashboard data
Dashboard settings	Description
Monitored Users	Displays the total number of users that the UBA app is actively monitoring.
High Risk Users	Displays the number of users who are currently exceeding the risk score. The value for determining the risk score is set in the "Risk threshold to trigger offenses" in UBA Settings.
Users Discovered from Events	Displays the number of users that are discovered from events, excluding imported users.
Users Imported from Directory	Displays the number of users that were imported from reference tables.
Active Analytics	Rules: Indicates the status of the rules content and how many rules are active. A green status indicates that the rules are installed and active. Gray indicates that the rules are disabled. Yellow indicates that the installation is in progress. Click to open the Rules and Tuning page. Note: In a multitenant environment, only an Admin user can see the rules installation status for either admin or tenant UBA. Tenant admin and tenant user always see a green status of rules on the dashboard. Tip: The rule count is based on the total number of rules that UBA knows exist, regardless of whether the rules are installed or not. Use Case Manager filtering is based on what is installed. For more information, see Supported QRadar content. Machine Learning: Indicates the status of Machine Learning and how many models are active. A green status indicates that the Machine Learning Analytics app is installed. Gray indicates that the Machine Learning Analytics app is not installed. Click to install or configure Machine Learning. Note: In a multitenant environment, the status is always Green.
Monitored users	Displays the top 10 riskiest users. Click a username to view available details on the User details panel. Recent risk: Shows the accumulated risk for the respective user for the last 5 minutes. Overall risk: Shows a line graph that illustrates the user's overall risk score trend for the last hour. The color of the graph indicates the overall riskiness. Watchlist icon: Add the user to a watchlist or create a watchlist. The number indicates how many watchlists the user is a member of. You can view all the tracked users on the Search page.
Recent offenses	Displays last five most recent offenses that are sorted by the time the offense was last updated.
[User] Watchlist	Watchlists that you created. You can create as many watchlists as you want and they display on the Dashboard. You can view all the tracked users in the custom watchlist that you created on the Search page. Tip: To add a user to a watchlist, click the Watchlist icon. The number indicates how many watchlists the user is a member of.
System score	Overall accumulated risk score for all users at a specified point in time. Click the Calendar icon to specify a date range for longer than one day. The maximum duration that you can select is 30 days any time during the last year. Note: If you are viewing a custom dashboard view, the System Score graph is not shown.
Risk category breakdown	High-level risk categories over the last hour. Click the graph to see subcategories and then click to see a display of events. Click the Table view icon to view the same information in a table format. Note: If you are viewing a custom dashboard view, the Risk category breakdown graph is not shown.
Users with dormant accounts	Watchlist of users that are flagged as having dormant accounts. The Users with Dormant Accounts is automatically generated.
Active investigations	Users that are currently under investigation. Select the My investigations checkbox to show only those investigations that you started.
Status of machine learning models	Status of the Machine Learning Analytics is visible if the Machine Learning app is installed. For more information, see UBA dashboard with Machine Learning.

User details page

You can click a user name from anywhere in the app to open the User details panel and see details for the selected user. To open the full User details page, click View user details on the panel.

You can learn more about the user's activities with the event viewer pane. The event viewer pane shows information about a selected activity or point in time. Clicking an event in the event viewer pane reveals more details such as syslog events and payload information. The event viewer pane is available for all donut and line graphs and activities in the Risky Activity Timeline on the User details page.

The User Details page includes the following user information:

Shows the name and aliases of the selected user and any additional details from attributes (including domain, manager, and peer information) that are imported from LDAP.
Shows the status (dormant, active, never used) of all the accounts that are found to be associated with the user.
If you have IBM QRadar Advisor with Watson 2.5.2 or later installed, you can search for information that is related to the user. You must have QRadar administrator privileges. Click the Search Watson icon.
To initiate an investigation on the user, click the Start Investigation icon. When your investigation is complete, click the End Investigation icon.
To add the user to a watchlist or create a watchlist, click the Watchlist icon.

The Advanced actions list includes the following actions:

Table 2. Advanced actions list
Advanced actions	Description
Add custom alert	You can set a custom alert that is displayed by the user name. Click Add Custom Alert, enter an alert message, and then click Set. To remove the custom alert for the selected user, click Remove Custom Alert.
Add to trusted users list	You must have QRadar administrator privileges. You can add the selected user to the trusted users list so that the user does not generate risk scores and offenses. To remove the selected user from the list, click Remove from trusted users list. To review the complete list of users who were added to the list, see Viewing the trusted users list.
Generate GDPR compliant report for user	You can generate a General Data Protection Regulation (GDPR) compliance report for the user. Important: Generate the report before you click Delete and stop tracking user.
Delete and stop tracking user	You must have QRadar administrator privileges. You can click Delete and stop tracking user to comply with General Data Protection Regulation (GDPR). Select Yes to permanently delete and stop tracking the user. To begin tracking the user again, delete the user's aliases from the `UBA : Users Not Tracked` reference set. To view all the user's aliases, download the GDPR report before you delete the user. For more information about the `UBA : Users Not Tracked` reference set, see Reference sets.
Always track with Machine Learning	You must have QRadar administrator privileges. You can click Always track with Machine Learning to add the user to the `UBA: ML Always Tracked Watchlist` reference set. Adding the user to the reference set provides the highest likelihood that the user is included in a machine learning model. For more information about reference sets in UBA, see Reference sets. To remove the selected user from the reference set, click Tracked with Machine Learning.

You can view the following information about the selected user:

Table 3. User details settings
User details	Description
Overall Risk Score	The overall risk score shows the risk trends for the user.
Timeline	The timeline graph shows Use cases and User events. Use cases are events that contribute to risk score. User events are all events triggered by the user. The Y-axis is event count and X-axis is time. You can click any activity in the timeline to open the event viewer pane that lists supporting log events that are associated with the user's activity. Click an event to view more details such as syslog events and payload information. Timeline activity is grouped by sessions and days. Sessions are defined in the Application Settings section of the UBA Settings page. The colors represent the overall riskiness of a session. Click the Calendar icon to specify the date range (1 - 14 days). You can customize the metric settings that display for the timeline by clicking the Metric Settings icon. You can add and remove the categories that you want to see. The data shown in the Example metrics section of the Metric Settings screen does not represent real values.
Recent Offenses	Shows any user type offense, where the user name matched any of the selected user's aliases. The last five offenses are displayed. Click an offense to open the Offenses tab in QRadar.
Risk Category Breakdown	Shows the risk categories of the selected user during the last hour.
Notes	Type a note in the in New note section to add a note for the selected user. The notes are automatically deleted after the 30-day retention period. Note: To save the note indefinitely, click the Keep forever icon.

You can configure some machine learning graphs to display on the User Details page if the Machine Learning Analytics app is installed and the specified model is enabled. For more information, see UBA dashboard with Machine Learning.

To return to the main UBA Overview page, click Overview.