IBM Security QRadar

 View Only

Import Identities from Multiple Sources and Systems into QRadar UBA

By PATEL MILAN posted Wed May 08, 2019 12:00 AM

  

Importing and coalescing identities is a breeze with IBM QRadar UBA!

The LDAP app in UBA provides a utility that guides admins through a 4 step process to import and merge identities of users for User Behavior Analytics.

Admins should export the identity and user data from the repository like IAM, HR, Proxy, Web, VPN directories into a flat csv file.

Then using the csv import feature of the LDAP app to import and coalesce identities in 4 easy steps.

Step 1:  Select the csf file for the identity data that you want to import into UBA Users reference map. 

Figure 1: Import User IdentitiesFigure 1: Import User Identities

Now, click on Next.

Step 2: Select the option to merge into an existing reference table.  Figure 2.

 
Figure 2: Option to create new or merge with an existing reference tableFigure 2: Option to create new or merge with an existing reference table


Step 3: Select an existing [Identity] reference table that you want to update with the additional identity and user information. Figure 3.

The app will automatically match the data fields in the imported file to the reference table to recommend the primary fields that can serve as primary matching key. Click on Next.

Figure 3: Select a reference tableFigure 3: Select a reference table


Figure 4: Option to create new or merge with an existing reference tableFigure 4: Option to create new or merge with an existing reference table

Step 4: Select the recommended and/or any other fields that you want to use as primary key to merge the imported user identity data. The app will gray out all the fields that it detects have non-unique values to each user, thereby disabling potential corruption of the identity data of users.

Figure 5: Start the import processFigure 5: Start the import process

Click Import (Figure 5) and the app will import and coalesce all the additional information about users from the new source.

Iterate through this process for each of the Identity directory that you want to import.



#QRadar
#QRadarUBA
0 comments
16 views

Permalink