Central UEBA table for custom reporting and widgets
This is an enhancement to the current UEBA feature which enables users to query central UEBA tables by running custom report.
To create a report dataset based on the central UEBA table:
- On FortiAnalyzer, go to Reports > Report Definitions > Datasets.
- Click Create New to create a new dataset based on
$ADOM_UEBA_USERS
and$ADOM_UEBA_HOSTS
. - Click Test to view test results.
- Run a report based on the dataset. The report is generated successfully and contains information from the UEBA central table.