You can import users from within the UBA app. The User Import wizard
helps you to import users from an LDAP server, an Active Directory server, from reference tables,
and CSV files.
Before you begin
You must configure the
UBA
authorization token and admin permissions before adding import configurations. For more information,
see
Configuring the authorization token in QRadar settings.
Important: The
User Import wizard allows you to import users and user data directly from the UBA app.
About this task
Note: The key names should always be in English. That means the attributes in reference
tables and LDAP servers should also be in English.
You can access the User
imports wizard from the following locations:
- The Admin Settings page ().
- The User Import icon in the top menu bar on the UBA dashboard.
- The Import User Data section on the UBA Settings page.
Procedure
-
On the User Imports window, click Add.
- From the following options, select the source that you want to use to import user
data:
- After you add an import, you can view the status information for each configuration.
- Retrieval limit: The maximum number of users to poll per poll.
- Polling interval: The time in hours after the last successful poll.
- Last edited: The last time the configured changed.
- Users extracted: The total number of users in the current import configuration.
Note: The
number of users extracted in each poll might be limited by a particular LDAP server. For example,
when Paged results is not selected, an Active Director Server could only return up to 1000
records.
- Last poll date: The last time a poll was attempted.
- Last poll status: The status of the last poll (Failed, Idle, Warning, Running, Coalescing,
Succeeded).
You can edit or delete the configuration. If you click the
Delete icon you can select from the following options:
- Delete the configuration only. Any users or data that are imported from this configuration
remains in UBA. This option removes the entry but does not remove the users from UBA.
- Delete the configuration and users. Any users and their data will be removed from UBA. This option removes both the
configuration and users from UBA.
- Delete the configuration, users, reference table, and map of sets. You will only see this option
if you selected the Synchronize reference table when you configured an
LDAP/AD import. Note: Reference tables and map of sets will not be removed if they are used by any
rule.
You can also select the
Import data now icon to poll the
server for data at any time.
Tip: To improve performance, you should delete import
configurations that you no longer use.
What to do next
Configure the import from your LDAP/AD server, CSV file, or a
reference table.