UBA : VPN Access By Service or Machine Account

The QRadar® User Behavior Analytics (UBA) app supports use cases based on rules for certain behavioral anomalies.

UBA : VPN Access By Service or Machine Account

Enabled by default

False

Default senseValue

10

Description

Detects when a Cisco VPN is accessed by a service or machine account. Accounts are listed in the 'UBA : Service, Machine Account' reference set. Edit this list to add or remove any accounts to flag from your environment.

Support rule

BB:UBA : VPN Mapping (logic)

Required configuration

Add the appropriate values to the following reference sets: "UBA : Service, Machine Account".

Log source types

Cisco Adaptive Security Appliance (ASA)