In this lab, you learn how to use the User Behavior Analytics for QRadar (UBA) application to detect anomalous or malicious behavior. The lab comes with UBA already installed and configured. You learn to use the QRadar UBA Dashboard and how the application can help you detect malicious user behavior.  The lab also walks you through the investigation process and demonstrates the integration with QRadar Advisor with Watson. The QRadar Advisor with Watson app is also already installed and configured in the lab. To learn more about QRadar Advisor with Watson, visit the dedicated section in the Security Learning Academy, where you can run the lab that is focused on QRadar Advisor with Watson. Finally, the lab walks you through tuning the rules for user risky behavior by configuring the senseValue parameter.

UBA leverages the Machine Learning (ML) app to analyze risky user behavior.  Because the Machine Learning part of the lab requires at least one week of historical data to properly analyze user behavior, it is not possible to demonstrate that feature in the lab that runs only about an hour. The machine learning part of QRadar UBA is covered in video training on the Security Leaning Academy.