Main Entities
The main entity that the module operates with is the object. To define the parameters of the object, its type is configured. Scoring types compatible with UBA allow generating score accruals for the object.
UBA Objects and Object Types
An object is a set of characteristics defined according to how the behavior of this object will be analyzed in the future.
An object contains basic and additional fields. These are configured by the object type.
Base Fields
This set of fields and their values must uniquely identify the object. For example, this could be a GUID, email address, or phone number. When forming the object's profile, the values of the basic fields will be matched with the fields from the source events.
Additional Fields
Additional fields serve as reference information about the object. They can be used to enrich the incident card, visualizations on dashboards, etc.
Scoring Types
Scoring types support compatibility with the UBA module.
When compatibility is enabled, three fields are added to the scoring type:
- UBA Object – used to identify the object
- UBA object type – indicates the type to which the object belongs
- Lifespan – used to set the time during which the score is active
By selecting such a scoring type in the task scheduler, you will be prompted to fill in these fields: