Skip to main content
Version: 6.0

Main Entities

The main entity that the module operates with is the object. To define the parameters of the object, its type is configured. Scoring types compatible with UBA allow generating score accruals for the object.

UBA Objects and Object Types​

An object is a set of characteristics defined according to how the behavior of this object will be analyzed in the future.

List of Objects

An object contains basic and additional fields. These are configured by the object type.

Types of objects​

To add a new object type or configure an existing one, navigate to Main Menu - Settings - Management - General - UBA - Object Types.

Object Type Settings

warning

The Type name field cannot be edited.

Base Fields​

This set of fields and their values must uniquely identify the object. For example, this could be a GUID, email address, or phone number. When forming the object's profile, the values of the basic fields will be matched with the fields from the source events.

Additional Fields​

Additional fields serve as reference information about the object. They can be used to enrich the incident card, visualizations on dashboards, etc.

Compatible Scoring Types​

A dropdown list of available scoring types. For more details, refer to the corresponding Scoring Types section.

Default type​

A parameter that defines the object type displayed by default when opening the Objects section in the User Behavior Analytics module.

Scoring Types​

Scoring types support compatibility with the UBA module.

Scoring Type Settings

Please note!

The Type Name field is not available for editing.

When compatibility is enabled, three fields are added to the scoring type:

  • UBA Object – used to identify the object
  • UBA object type – indicates the type to which the object belongs
  • Lifespan – used to set the time during which the score is active
  • Drilldown – configures the drilldown type for transitioning from the UBA object score history, containing the following list of values:
    • None - no drilldown
    • Search - search query with the ability to specify a time boundary for drilldown
    • Link - drilldown by link

By selecting such a scoring type in the job scheduler, you will be prompted to fill in these fields:

Scoring Settings