Home Security QRadar SIEM User behavior analytics with IBM Security QRadar SIEM
Gain greater visibility into insider threats, uncover anomalous behavior, quickly identify risky users and generate meaningful insights
Book a demo of QRadar SIEM See the Fall G2 Grid report for UEBA
Person writing on whiteboard in office
Detect compromised credentials, lateral movement and other malicious behavior

IBM Security® QRadar® SIEM User Behavior Analytics (UBA) establishes a baseline of behavior patterns for your employees, so you can better detect threats to your organization. It uses existing data in QRadar SIEM to generate new insights around users and risk.

By establishing the risk profiles for users inside your network, you can react more quickly to suspicious activity, whether from identity theft, hacking, phishing or malware.

Learn more about UBA

Detecting Insider Threats with UBA

It really just takes one employee to click a link, give their credentials or open up an attachment—that could lead to a total compromise. Stephanie “Snow” Carruthers Chief People Hacker IBM Security® X-Force® Red
UBA protects against phishing and more

Distinguish normal user behavior from anomalies to stop threats


41% of network infections are caused by phishing.¹


More than 50% of phishing attacks use spear phishing techniques.2


There has been a 100% increase per month in threat hijacking attempts, as observed by X-Force® threat detection software.3

How it works

For the second year in a row, phishing was the leading infection vector where an attacker impersonates someone and uses existing email conversations for nefarious purposes. Understanding users’ normal behavior and noticing anomalies fast is critical to stopping infections. You can add users with the user import wizard, and add risk scoring and unified user identities to QRadar SIEM with UBA.

User import wizard 

The user import wizard allows you to import users and user data directly from the UBA app. The user import wizard helps you to import users from an LDAP server, an active directory server, reference tables and CSV files. You can also create custom attributes with the user import wizard.

Risk scoring 

Create risk profiles by assigning risk to different security use cases, depending on the severity and reliability of the incident and by using existing event and flow data in your QRadar system. A risk profile might rely on simple rules, such as if a user visits harmful or compromised websites, or include stateful analytics that use machine learning.  

Unified user identities 

Build unified user identities by combining disparate accounts for a QRadar user. By importing data from an active directory, LDAP, reference table or CSV file, the UBA app can be taught what accounts belong to each user. This also helps you combine risk and traffic data across different usernames in the UBA app, so you can better monitor user actions and prevent attacks.  

What's included
Machine learning add-on

Enrich and deepen your use cases to perform time series profiling and clustering with the machine learning add-on, which augments the UBA app. Machine learning adds to existing UBA app visualizations that show learned behavior (models), current behavior and alerts. Machine learning uses historical data in QRadar to create the predictive models and baselines of what is normal for a user.  

Read about machine learning analytics

Rules and tuning

UBA rule content is installed after the app is configured and can be edited in the QRadar use case manager app. Rules that measure user risk are added to the UBA rule data table. UBA rules and tuning features allow you to determine the parameters that QRadar SIEM will use to keep your company and data protected.

Explore rules and tuning


Yes. If running on a QRadar SIEM console, the UBA app requires a minimum of 64 GB or up to 128 GB of memory. Additionally, consider the deployment of a QRadar SIEM app host to access the full benefits of running the UBA app with the machine learning app enabled.

UBA integrates directly into QRadar SIEM by using the existing user interface and database. All enterprise-wide security data remains in one central location and analysts can tune rules, generate reports and connect data as part of their SIEM experience.

Since UBA shares the same underlying database as QRadar SIEM and NDR, any data source that is ingested by QRadar SIEM can be surfaced and leveraged in UBA.

UBA is packaged as a collection of 3 apps—an LDAP app that helps ingest and coalesce users' identity information, a UBA app that helps visualize data and analytics, and a machine learning app that provides a library of machine learning algorithms used to create behavioral models of users' activities.

Anomaly detection is a technique used to identify unusual patterns that do not conform to normal behavior and differ significantly from most of the data. UBA builds a baseline of normal behavior from a user’s and similar users’ (peers) events and then uses that baseline to detect anomalous behavior.

A risk score is the numeric measure of the potential harmfulness of a user's activity. Each anomalous behavior that is detected by UBA impacts an individual user's risk score.

A risk score is the numeric measure of the potential harmfulness of a user's activity. Each anomalous behavior that is detected by UBA impacts an individual user's risk score.

Upon installation, machine learning algorithms ingest the previous 4 weeks of data from the QRadar database and can take up to 1 week to build the baseline models of normal user behavior.

The UBA app can be deployed in IBM Security® QRadar® SaaS, software or cloud deployments.

The UBA app is offered to QRadar clients at no additional cost.

As with all QRadar applications and modules, the data is encrypted at rest.


Explore additional documentation about how the QRadar SIEM UBA app helps you protect valuable data and assets from insider threats.

See the QRadar SIEM User Behavior Analytics (UBA) technical document 
Take the next step

Get started by requesting a demo of QRadar SIEM to learn how the user behavior analytics tool can protect your company from cyberthreats.

Request a demo
More ways to explore Documentation Support Community Partners Resources