Installing and configuring UBA instances to support multitenancy

You can set up UBA to work in a multitenant environment in QRadar® 7.4.3 Fix Pack 6 or later.

Before you begin

You must complete the steps that are outlined in the table on the QRadar configurations for setting up multitenancy in UBA page on a system with QRadar 7.4.3 Fix Pack 6 or later.

Before you attempt to configure any UBA instance, make sure you have an Admin instance of UBA installed by completing the following steps Installing the User Behavior Analytics app.

Attention:
  • Installing instances requires IBM QRadar Assistant app 3.0.0 or later. For more information, see QRadar Assistant app.
  • Do not uninstall the Admin or shared instance.

About this task

The following procedure must be completed by the QRadar Admin or the MSSP admin.

Procedure

  1. Find the User Behavior Analytics extension in the IBM QRadar Assistant app.
    Installed UBA instance in IBM QRadar Assistant app
  2. Select Options > Create new instance.
  3. Choose the security profile for the instance and click Next.

    Note: If there are no instances created, create an Admin instance first. If there is an Admin or Shared instance, create the first tenant instance. If the tenant security profile is not listed, ensure that you have created a security profile and deployed changes.

  4. Associate the app to any other roles that are listed and click Next.
  5. Review the summary and click Confirm and Create.
  6. After the instance is created, select the instance and then click Options > Configure Instance > UBA Settings.
  7. On the UBA Settings page, add the service token for the tenant admin that is responsible for the instance of UBA. Note: Make sure to choose the correct token.
  8. Enter the identifier set for the IBM Sense log source for this instance's domain. For more information, see step 1 of QRadar configurations for setting up multitenancy in UBA.
  9. Save the configuration.
  10. Optional: If this instance of UBA will also host Machine Learning, see the following topic Installing and configuring Machine Learning in Multitenancy.

What to do next

Repeat these steps for all instances of UBA that you want.