UBA : Terminated User Activity

The QRadar® User Behavior Analytics (UBA) app supports use cases based on rules for certain behavioral anomalies.

UBA : Terminated User Activity

Enabled by default


Default senseValue



Detects activity from any user that is listed as terminated or resigned.

Required configuration

Add the appropriate values to the following reference sets: "UBA : Terminated Users".
Note: This rule does not ignore any log sources.

Log source types

Any log source that provides a username.