IBM Support

QRadar: User Behavior Analytics Best Practice - Machine Learning

Troubleshooting


Problem

The Machine Learning component of User Behavior Analytics (UBA) allows administrators to enrich their user monitoring with historical data. There are a variety of use cases that can track different facets of the users' activity. This document summarizes the capabilities of this function, and provides some suggestions for the initial configuration as well as some troubleshooting steps.

Resolving The Problem

Installing Machine Learning

There are three supported methods for importing users into UBA. Administrators can import users from any combination of these sources, and are allowed multiple configurations of the same type. For the step-by-step process on adding import configurations, see Importing Users.

Enabling Models

After completing at least one user import configuration, administrators can refine and customize how the attributes are displayed through the Tuning Page.
 

Machine Learning FAQ

  • My model isn't showing Success
    The models can take a long time to build completely, depending on the type of events required, etc

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
12 April 2024

UID

ibm17148251