You can add a user to a new watchlist or an existing watchlist.
About this task
You can add a user to a new watchlist or an existing watchlist from the main UBA Overview (Dashboard) page, the
User Details page, or the Search Results page. A single
user can be a member of multiple watchlists. To add the user to a watchlist or create a
watchlist, click the Watchlist icon.
Procedure
-
From the main UBA Overview
(Dashboard) page or the User Details page, click the
Watchlist
icon.
-
From the menu, select Create new watchlist. To add a user to an existing
watchlist, click Add to your watchlist.
-
On the General Settings tab, enter a watchlist name.
-
You can artificially increase or decrease the user's risk score by changing the value in the
Scale risk by factor field. The default factor of '1' leaves the risk score
unchanged.
Note: If a user is in more than one watchlist, the largest scale factor is applied.
-
In the Machine Learning tracking priority section, select the priority
for how users are tracked by the Machine Learning analytics.
- High - Users are always tracked up to the maximum users per Machine
Learning
analytic.
- Normal - Users are tracked by highest risk after all the high users are included.
- Never - Users are not tracked by Machine
Learning.
-
Click Next.
The following example shows 4.0.0 with light theme UI.
-
On the Membership settings tab, you can automatically populate the
watchlist with users from a reference set, a regular expression, or both.
- Optional:
In the Import from QRadar® reference
set field, search for a reference set or click to select a reference set from the list
to import all entries from the reference set. Note: The list might contain reference sets that do
not have user names. After you select a reference set, click the link to review.
- Optional:
In the Add from monitored users with regex filter
field, you can select a user property and enter a valid Python regular expression to select users
who are already found in the UBA database.
-
In the Refresh interval field, enter the number of hours for how often
you want the user list to be updated.
For example, if you enter 10, the user list is updated every 10 hours.
If the Refresh interval is set to a value of 0 (zero), you can manually
update the watchlist by clicking Refresh.
-
Click Save.
The following example shows 4.0.0 with light theme UI.
