QRadar: User UBA recent risk score is 0

Resolving The Problem

1. Log on to your QRadar console web UI.
2. Open the User Analytics tab.
3. Click the user you want to investigate. In this example, we investigate autouser.
4. Click View user details.
5.  Look at the list of events under the Timeline.
   
   
   Result
   If no new events with an associated risk score came in the last 5 minutes, the expected behavior is for Recent Risk to be 0. If there are events, wait five minutes for the next polling interval to confirm you are still seeing the issue, then contact support. WinCollect users can follow the extra troubleshooting steps if they believe events are failing to reach the User Behavior Analytics app or failing to be associated with the user.

1. Log on to the windows device associated with the user you want to test.
2. Open the command prompt as an administrator.
3. Create a test event by using the following command:

   eventcreate /l SYSTEM /u [username as seen in UBA] /t ERROR /d “uba test event” /id 1 /s [device name]

   If you have trouble finding the username and device name, you can look at one of the past events you received from this user in the User Behavior Analytics app. The Username field contains your username, and the Log Source field contains the device name after the "at" (@) symbol.
   
   If the eventcreate command asks for the user password, enter it. The successful output is the following:

   SUCCESS: An event of type ‘ERROR’ was created with ‘system’ as the log

4. Return to the user Timeline in the User Analytics tab and select Events from the most recent entry in the timeline.
5. Check for a System Error Event and select it.
   
6. Confirm the payload message contains "uba test event".
   
   
   Result
   Finding the test event on the user's timeline confirms the User Behavior Analytics app is processing the events and associating them with the correct user.