IBM WATSON

The volume of security incidents and available threat data far exceed the capacity of even the most skilled security professional. Enter Watson for Cyber Security. It augments a security analyst’s ability to identify and understand sophisticated threats, by tapping into unstructured data (ex. blogs, websites, research papers) and correlating it with local security offenses. IBM QRadar Advisor with Watson combines the cognitive capabilities of Watson and the industry leading QRadar Security Analytics Platform to uncover hidden threats and automate insights, revolutionizing the way security analysts work.

AI is trained by consuming billions of data artifacts from both structured and unstructured sources, such as blogs and news stories. Through machine learning and deep learning techniques, the AI improves its knowledge to “understand” cybersecurity threats and cyber risk.

AI gathers insights and uses reasoning to identify the relationships between threats, such as malicious files, suspicious IP addresses or insiders. This analysis takes seconds or minutes, allowing security analysts to respond to threats up to 60 times faster.

AI eliminates time-consuming research tasks and provides curated analysis of risks, reducing the amount of time security analysts take to make the critical decisions and launch an orchestrated response to remediate the threat.

Automated investigations of incidents

Free up your time and let QRadar Advisor with Watson start the investigation for you. It starts by performing local data mining using observables in the incident to gather broader local context. Then it quickly assesses to see if threats bypassed your layered defenses or was blocked. With watch lists, you can also automate hunting for specific indicators to get a head start.

Artificial intelligence that reasons

Apply cognitive reasoning to identify the likely threat and connect threat entities related to the original incident such as malicious files, suspicious IP addresses, and rogue entities to draw relationships among these entities. Automatically tap into Watson for Cyber Security to apply external unstructured data including threat intelligence feeds, websites, forums, and more.

Identification of high priority risks

Get insights that show criticality of an incident, such as whether or not a malware has executed, with supporting evidence to focus your time on the higher risk threats. Then make a decision quickly on the best response method for your business.

Key insights on users and critical assets

Realize reach of threats and its effects on users and high valued assets. Gain visibility to suspicious behavior from insiders through integration with the User Behavior Analytics (UBA) App and understand how certain activities or profiles impact systems.

IBM QRadar

IBM® QRadar® Security Information and Event Management (SIEM) helps security teams accurately detect and prioritize threats across the enterprise, and it provides intelligent insights that enable teams to respond quickly to reduce the impact of incidents. By consolidating log events and network flow data from thousands of devices, endpoints and applications distributed throughout your network, QRadar correlates all this different information and aggregates related events into single alerts to accelerates incident analysis and remediation.  QRadar SIEM is available on premises and in a cloud environment.

Extend your QRadar Security intelligence Platform with cutting-edge solutions, fully integrated in your QRadar solution!

What QRadar Vulnerability Manager can do for your business?

IBM® QRadar® Vulnerability Manager senses security vulnerabilities, adds context and helps prioritize remediation activities. Fully integrated with the QRadar Security Intelligence Platform, it uses advanced analytics to enrich the results of vulnerability scans to lower risk and achieve compliance. QRadar Vulnerability Manager correlates vulnerability data with network topology and connection data to intelligently manage risk. A policy engine automates compliance checks. Using QRadar Vulnerability Manager will help your security team develop an optimized action plan to address security exposures to work more efficiently and decrease costs.

What can QRadar Network Insights do for your business?

Attackers can’t hide on your network with IBM® QRadar® Network Insights. Security teams are flooded with security log activity every day, but inspecting those logs does not always generate the level of insight required to detect modern threats. They are eager to find additional methods to provide more accurate threat detection. QRadar Network Insights analyzes network data in real-time to uncover an attacker’s footprints and expose hidden security threats in many scenarios before they can damage your organization, including: phishing e-mails, malware, data exfiltration, lateral movement, DNS and other application abuse, and compliance gaps.

What can QRadar User Behaviour Analytics do for your business?

IBM® QRadar® User Behavior Analytics (UBA) analyzes user activity to detect malicious insiders and determine if a user’s credentials have been compromised. As a component of the QRadar Security Intelligence Platform, QRadar UBA adds user context to network, log, vulnerability and threat data to more quickly and accurately detect attacks. Security analysts can easily see risky users, view their anomalous activities and drill down into the underlying log and flow data that contributed to a user’s risk score. QRadar is available in the IBM Security App Exchange and can be downloaded and installed in minutes.

What can QRadar Incident Forensics do for your business?

IBM® QRadar® Incident Forensics allows you to retrace the step-by-step actions of a potential attacker and quickly and easily conduct an in-depth forensics investigation of suspected malicious network security incidents. It reduces the time it takes security teams to investigate QRadar offense records, in many cases from days to hours—or even minutes. It can also help you remediate a network security breach and prevent it from happening again. IBM QRadar Packet Capture appliances are also available to store and manage data if no other network packet capture (PCAP) device is deployed.

What can Artifical Intelligence do for security analysts?

The volume of security incidents and available threat data far exceed the capacity of even the most skilled security professional. Enter Watson for Cyber Security. It augments a security analyst’s ability to identify and understand sophisticated threats, by tapping into unstructured data (ex. blogs, websites, research papers) and correlating it with local security offenses. IBM QRadar Advisor with Watson combines the cognitive capabilities of Watson and the industry leading QRadar Security Analytics Platform to uncover hidden threats and automate insights, revolutionizing the way security analysts work.

QRadar App Exchange

The IBM Security App Exchange is an ecosystem that lets you extend the capabilities of IBM Security solutions with a host of ready-to-install Business Partner apps and add-ons.

The collaborative platform allows you – whether a customer, developer or business partner – to share and install applications, security app extensions and enhancements to IBM Security solutions to fight the bad guys.

With the IBM Security App Exchange, your enterprise can:

• Increase efficiency and performance of your security solutions with ready-to-install apps
• Find solutions in near real-time
• Improve security app integration and data sharing
• Share best practices and learn from others