UEBA are essentially selected using an LDAP enrichment source, so if you can write an LDAP query that gets you the right user objects then you’re fine to use that with UEBA. That’s not a direct yes or no because I don’t know people’s Active Directory layouts well enough :)
1 comment