Prerequisites for installing the User Behavior Analytics app

Before you install the User Behavior Analytics (UBA) app, ensure that you meet the requirements.

  • Verify that you have IBM® Security QRadar® 7.4.3 Fix Pack 6 or later installed.
  • Add the IBM Sense DSM for the User Behavior Analytics (UBA) app.

Installing the IBM Sense DSM manually

The User Behavior Analytics (UBA) app uses the IBM Sense DSM to add user risk scores and offenses into QRadar. You can install the DSM through auto-updates or you can upload to QRadar and install it manually.
Note: If your system is disconnected from the internet, you might need to install the DSM RPM manually.
Restriction: Uninstalling a Device Support Module (DSM) is not supported in QRadar.
  1. Download the DSM RPM file from the IBM support website:
    • For QRadar 7.4.0 and later: DSM-IBMSense-7.4-20200812144513.noarch.rpm
  2. Copy the RPM file to your QRadar Console.
  3. Use SSH to log in to the QRadar host as the root user.
  4. Go to the directory that includes the downloaded file.
  5. Type the following command:

    rpm -Uvh <rpm_filename>

  6. From the Admin settings, click Deploy Changes.
  7. From the Admin settings, select Advanced > Restart Web Services.