UEBA common challenges
This topic describes the common challenges UEBA users face and the best practices to address these challenges.
- User Coalescing – Multiple LDAP fields are used for aliases
- Display Fields – Multiple fields are configured for Display name and Full name
- User Discovery – users discovered from events vs users imported from active directory
- LDAP Filters – Setting a wrong filter or no filter could lead to a large amount of identities getting imported to UEBA
- Enabling Index – Having this disabled could lead to search performance issues and overall app slowness
User Coalescing – Multiple LDAP fields are used for aliases
Complete the procedure to address this challenge:
- Identify one or two aliases/attributes for users that are unique across all ADs.
- Start small and then add more attributes if needed.
- Recommended attributes:
- sAMAccountName
- uid
- userPrincipalName
- cn
Note: The procedure can also improve UEBA performance due to less user records.
Display Fields – Multiple fields are configured for Display name and Full name
The inconsistent use of Display name and Full name can cause confusions. Complete the procedure to address this challenge:
- Identify the correct attribute against each field which should display in the user profile.
- If distinguishedname and displayname attribute are used for Display name then the Display name will use distinguishedname attribute if available.
- Display name uses first available attribute in order.
User Discovery – users discovered from events vs users imported from active directory
Complete the procedure to address this challenge:
- Enable the Monitor imported user only setting in QRadar Settings, if your use case requires you to monitor AD imported users.
Note: The procedure is also useful when you only recently started using UEBA. Once you have all the needed
users imported from AD, you may then want to discover users from events and monitor risks.
LDAP Filters – Setting a wrong filter or no filter could lead to a large amount of identities getting imported to UEBA
Complete the procedure to address this challenge:
- Set LDAP filters in LDAP server configuration. For example:
- (objectClass=person) : All users and service accounts will be coalesced.
- (objectClass=user) : Only user accounts will be coalesced.
- For more information about constructing LDAP filters, see https://ldap.com/ldap-filters/.
Note:
- Default Retrieval Limit: UBA retrieves users in chunks and default settings is 500,000.
- Slow LDAP connection can cause timeouts.
- Set the chunk size to around 100,000 to retain system stability.
Enabling Index – Having this disabled could lead to search performance issues and overall app slowness
Complete the procedure to address this challenge:
- Enable Index in QRadar® to optimize system performance.
