QRadar configurations for setting up multitenancy in UBA
You must configure your QRadar® system to support UBA 3.6.0 and later in a multitenant environment.
You must have QRadar administrator privileges to set up your multitenant environment. For more information, see QRadar administration.
For more information about multitenancy in QRadar, see Multitenant management.
Step | More information | |
---|---|---|
1 | Define IBM Sense log source for each domain. ( ) |
Each domain requires it's own IBM Sense log source for each UBA instance to function properly. Important: When the log source is defined, take note of each unique IBM identifier for use when configuring the tenant UBA instance. The identifier that is used in creating the IBM Sense log source for each instance is also added to the settings for each instance. This identifier tells the UBA instance which log source will be used in processing its sense events. Note: Only the first or "admin" instance of UBA will have an IBM Sense log
source created by default. You must create an IBM Sense log source for additional UBA tenants.
|
2 | Optional: Determine data provisioning. ( ) |
You can assign specific log sources, log source groups, or event collectors to provide data for each domain. You can create the log source groups. Assign the IBM Sense from step one to the specific group if one is created. |
3 | Define a set of tenants in Tenant Management ( ) |
Provisioning a new tenant |
4 | Define a set of domains in Domain Management ( ) |
Associate the IBM Sense log source from step 1 (if log source groups are not used), and log source groups, logs sources, or event collectors from step 2. Add a tenant from step 3. Each domain must have a unique tenant and log source or log source group. Creating domains |
5 | Optional: Define networks in Network Hierarchy
( ) |
Note: This is only necessary if you want each tenant to have specific network hierarchy Network hierarchy updates in a multitenant deployment |
6 | Create a profile for each domain in Security Profiles ( ) |
Associate the previously defined domain, log source, or log source group, and network. Note: Permission precedence must be set to No restrictions.
|
7 |
Create roles in User Roles and then deploy changes. ( ) |
QRadar admin/MSSP admin: Install and configure each UBA and Machine Learning instance. See QRadar admin/MSSP admin for details. Tenant admin: UBA Admin role for administering a UBA and Machine Learning instance. See UBA tenant admin for details. Tenant user: UBA Analyst role for reviewing data in UBA. See UBA tenant user for details. Note: User Analytics, Machine Learning, and QRadar Advisor with Watson™ might not be available at this point. On the Admin tab, click Deploy changes. |
8 | Create service tokens in Authorized Services ( ) |
Associate to profile from step 6 and role from step 7. Each tenant admin requires an authorization service token. Configuring the authorization token in QRadar settings |
9 | Create users in Users ( ) |
Create tenant admin and tenant users. Associate each to the specific role, profile, and tenant. Creating a user account |
10 | Deploy changes | On the Admin tab, click Deploy changes. |
![Configuration for QRadar and UBA multitenancy](qapps_uba_qr_admin_config.jpg)