Known issues

The QRadar® User Entity Behavior Analytics app has required information for upgrading and known issues.

Known issues

The QRadar User Entity Behavior Analytics app has the following known issues:
  • When you try to install User Entity Behavior Analytics 4.1.17 on QRadar 7.5.0 Update Package 10 or later, you see an error message that the application is not supported. The workaround is to update the minimum permitted app base image stream in QRadar.
    1. Go to Admin > System Settings > Minimum Permitted App Base Image Stream.
    2. Change the version from v4+ (RHEL with Python 3.11) to v3+ (RHEL with Python 3.8), and then deploy the changes.
  • In User Entity Behavior Analytics 4.1.13 and later, the QRadar APIs make repeated calls to determine whether User Entity Behavior Analytics is running on a QRadar on Cloud instance. These calls result in numerous API failure messages in the audit logs.
  • In User Entity Behavior Analytics 4.1.7 and 4.1.8, if you select Generate map of sets when importing users with LDAP or Active Directory, you might experience a timeout failure with larger data sets. This is due to a problem in the api/reference_data/map_of_sets/bulk_load/ QRadar API endpoint that is taking progressively longer times to return a status when called as the data in the table grows.
  • Because of the changes that are implemented to fix issues with user imports in User Entity Behavior Analytics 4.1.7, performance during coalescing might be slow. Consider decreasing the number of aliases to reduce performance impact.
  • In 4.0.0 and later, the User Entity Behavior Analytics dashboard might be slow to display the Active Analytics on some QRadar systems.
  • Enabling Search assets for username, when username is not available for event or flow data on the UBA Settings page can cause the User Details page to not load. Review the Rules pages to determine whether the enabled rules require this setting. Disable the setting if it is not needed.
  • In previous releases, new users were designated to User Entity Behavior Analytics in a way that used the "UBA : User Accounts, Successful, Observed" reference set. This reference set is no longer used. If you are experiencing performance issues because of the reference set after upgrading to V3.5.0 or later, consider deleting the data from the reference set. Also, if you previously edited the "UBA : New Account Use Detected" rule, consider reverting it back to the default setting to get the newer version.
  • If you are upgrading the User Entity Behavior Analytics app and you receive a QRadar Notification exception error stating that a rule set has failed to load, you can ignore it and continue. If the error persists, contact IBM® Customer Support.
  • After you upgrade User Entity Behavior Analytics, the Machine Learning Activity Distribution graph on the User Details page can take up to one day to display.