UBA : Terminated User Activity
The QRadar® User Behavior Analytics (UBA) app supports use cases based on rules for certain behavioral anomalies.
UBA : Terminated User Activity
Enabled by default
False
Default senseValue
25
Description
Detects activity from any user that is listed as terminated or resigned.
Required configuration
Add the appropriate values to the following reference sets: "UBA : Terminated Users".
Note: This
rule does not ignore any log sources.
Log source types
Any log source that provides a username.