UEBA synchronization for entities import data with reference tables

IBM® QRadar® User Entity Behavior Analytics (UEBA) supports synchronization between imported entity data and QRadar reference tables to ensure that entity information remains consistent.

Synchronization overview

Synchronization ensures that entity information in UEBA remains aligned with data that is maintained in QRadar reference tables. When synchronization is configured, UEBA automatically retrieves and processes entity records from the selected reference table at regular intervals.

Synchronization process

The synchronization process follows these steps:

  1. An administrator configures a reference table import.
  2. UEBA retrieves entity records from the selected reference table.
  3. Imported records are validated before processing.
  4. Valid entities are imported into UEBA.
  5. UEBA continues to retrieve updates based on the configured polling interval.

Synchronization settings

The synchronization process can be configured by using the following settings:

Polling interval
Specifies how frequently UEBA polls the reference table for updates.
Retrieval limit
Defines the maximum number of records that are retrieved during each polling cycle.
Reference table synchronization
Enables or disables automatic synchronization with the selected reference table.

Polling behavior

When synchronization is enabled, UEBA exhibits the following polling behavior:

  • UEBA automatically polls the configured reference table at the specified interval.
  • New and updated records are processed during each polling cycle.
  • Records that fail validation are skipped.
  • Administrators can trigger an immediate synchronization using Poll Now.

This synchronization mechanism helps ensure that entity information in UEBA remains aligned with data that is maintained in QRadar reference tables.