Known issues

The QRadar® User Behavior Analytics app has required information for upgrading and known issues.

Known issues

The QRadar User Behavior Analytics app has the following known issues:
  • In UBA 4.1.7 and 4.1.8, if you select Generate map of sets when importing users with LDAP or Active Directory, you might experience a timeout failure with larger data sets. This is due to a problem in the api/reference_data/map_of_sets/bulk_load/ QRadar API endpoint taking progressively longer times to return a status when called as the data in the table grows.
  • Because of the changes implemented to fix issues with user imports in UBA 4.1.7, performance during coalescing might be slow. Consider decreasing the number of aliases to reduce performance impact.
  • In 4.0.0 and later, the UBA dashboard might be slow to display the Active Analytics on some QRadar systems.
  • Enabling Search assets for username, when username is not available for event or flow data on the UBA Settings page can cause the User Details page to not load. Review the Rules pages to determine if the enabled rules require this setting. It should be disabled if it is not needed.
  • In previous releases, new users were designated to UBA in a way that used the "UBA : User Accounts, Successful, Observed" reference set. This reference set is no longer used. If you are experiencing performance issues because of the reference set after upgrading to V3.5.0 or later, you should consider deleting the data from the reference set. Also, if you previously edited the "UBA : New Account Use Detected" rule, you should consider reverting it back to the default setting to get the newer version.
  • If you are upgrading the UBA app and you receive a QRadar Notification exception error stating that a rule set has failed to load, you can ignore it and continue. If the error persists, contact IBM® Customer Support.
  • After you upgrade UBA, the Machine Learning Activity Distribution graph on the User Details page can take up to one day to display.