Hi David,
Thanks for your kind answer. As I understand it, UBA is not able to collect raw data but needs a indirection layer like Bro or Splunk Enterprise. My question is does Bro do the same thing as ArcSight? If we already have ArcSight in the environment and send the date from ArcSight to UBA, does it make any difference? Thanks in advance!
... View more