Upgrading the UBA app

To take advantage of new capabilities, defect fixes, and updated workflows, upgrade to new versions of QRadar® User Behavior Analytics ( UBA). Use the Extensions Management tool in IBM® QRadar to upgrade your app, or use the IBM QRadar Assistant app to upgrade. You must be an administrator to upgrade to new versions of the app.

Before you begin

Important: Before you upgrade the app, ensure that IBM QRadar meets the minimum memory (RAM) requirements. The UBA app requires 1 GB of free memory from the application pool of memory. The UBA app will fail to upgrade if the application pool does not have enough free memory.

About this task

Note: If you customized your dashboard layout in releases prior to 4.0.0, the UI will reset to the default layout when you upgrade.

Procedure

  1. Choose one of the following methods to download your app:
    • If the IBM QRadar Assistant app is not configured, download the User Behavior Analytics app archive from the IBM Security App Exchange (https://apps.xforce.ibmcloud.com/) onto your local computer. You must have an IBM ID to access the App Exchange.
  2. If you downloaded the app from the IBM Security App Exchange, complete the following steps:
    1. On the QRadar Console, click Admin > Extensions Management.
    2. In the Extension Management window, click Add and select the app archive that you want to upload to the console.
    3. Select the Install immediately checkbox.
      Important: You might have to wait several minutes before your app becomes active.
    4. To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.
  3. Upgrade the UBA app.
    • If the IBM QRadar Assistant app is configured on QRadar, use the following instructions to install the UBA app: Downloading apps with the QRadar Assistant app.
    • If the IBM QRadar Assistant is not configured, download the UBA app archive from the IBM Security App Exchange onto your local computer. You must have an IBM ID to access the IBM Security App Exchange.
  4. In the window that prompts you to update the current app version, leave the Replace existing items option selected and click Install. All of your existing app data remains intact.
    Important: You might have to wait several minutes before your app becomes active. After the UBA app is upgraded, the content packages are upgraded in the background. The content might not be visible in QRadar immediately after the app is upgraded.
    Note: After the UBA upgrade completes, content packages are upgraded automatically if the Install and upgrade UBA content packages setting is enabled on the Configuring content package settings page. For more information about content packages, see UBA content pack summary.
  5. If the Machine Learning Analytics app is installed, the UBA app automatically upgrades the ML app version.

What to do next

When the upgrade is complete, clear your browser cache and refresh the browser window before you use the app.