Investigating users from the UBA app

You can select users from the QRadar® User Behavior Analytics (UBA) app to send to QRadar Advisor with Watson™ for investigation.

Before you begin

  • You must have User Behavior Analytics (UBA) 3.5.0 or later installed and configured with user data.
  • You must have Admin privileges.
For more information, see https://exchange.xforce.ibmcloud.com/hub/extension/IBMQRadar:UserBehaviorAnalytics

About this task

Procedure

  1. From the navigation menu, click User Analytics to open the UBA Dashboard.
  2. Select a user or search for a user to open the User Details page.
  3. Click the Search Watson icon.
    When the icon stops spinning, the Watson Investigations ID details page opens and you can review your results in the QRadar Advisor with Watson app.