Importing users

You can import users from within the UBA app. The User Import wizard helps you to import users from an LDAP server, an Active Directory server, from reference tables, and CSV files.

Before you begin

You must configure the UBA authorization token and admin permissions before adding import configurations. For more information, see Configuring the authorization token in QRadar settings.
Important: The User Import wizard allows you to import users and user data directly from the UBA app.

About this task

Note: The key names should always be in English. That means the attributes in reference tables and LDAP servers should also be in English.

You can access the User imports wizard from the following locations:
  • The Admin Settings page (Admin Settings > User Analytics > User Import).
  • The User Import icon in the top menu bar on the UBA dashboard.
  • The Import User Data section on the UBA Settings page.

Procedure

  1. On the User Imports window, click Add.
  2. From the following options, select the source that you want to use to import user data:
  3. After you add an import, you can view the status information for each configuration.
    • Retrieval limit: The maximum number of users to poll per poll.
    • Polling interval: The time in hours after the last successful poll.
    • Last edited: The last time the configured changed.
    • Users extracted: The total number of users in the current import configuration.

      Note: The number of users extracted in each poll might be limited by a particular LDAP server. For example, when Paged results is not selected, an Active Director Server could only return up to 1000 records.

    • Last poll date: The last time a poll was attempted.
    • Last poll status: The status of the last poll (Failed, Idle, Warning, Running, Coalescing, Succeeded).
    You can edit or delete the configuration. If you click the Delete icon you can select from the following options:
    • Delete the configuration only. Any users or data that are imported from this configuration remains in UBA. This option removes the entry but does not remove the users from UBA.
    • Delete the configuration and users. Any users and their data will be removed from UBA. This option removes both the configuration and users from UBA.
    • Delete the configuration, users, reference table, and map of sets. You will only see this option if you selected the Synchronize reference table when you configured an LDAP/AD import. Note: Reference tables and map of sets will not be removed if they are used by any rule.
    You can also select the Import data now icon to poll the server for data at any time.
    Tip: To improve performance, you should delete import configurations that you no longer use.

What to do next

Configure the import from your LDAP/AD server, CSV file, or a reference table.