Professional Security Information and Event Management (SIEM) is indispensable for companies

The diverse threat situation for companies in the economy demands that the topic of security be understood as a management task and that strategic action be taken as a result. To this end, it is necessary to formulate a security strategy and adapt it to the corporate strategy. Successful implementation depends to a large extent on appropriately qualified employees. CANCOM supports you with expertise and software solutions in the development and implementation of these strategies.

IBM QRadar Security Intelligence Platform products provide a unified architecture for integrating security information and event management (SIEM), log management, irregularity detection, incident forensics, and configuration and vulnerability management. In addition, these products can optimize security threat detection, improve user experience and reduce total cost of ownership. IBM QRadar Security Intelligence Platform products offer the following.

Advantages:

• Centralized architecture for analysis of log, flow, vulnerability, user and asset data

• Real-time correlation and detection of behavioral anomalies to identify high security risks

• High-priority incident detection from billions of data entries

• Comprehensive visibility into network, application, and user activity

• Automated compliance with collection, correlation, and reporting capabilities

The modular product suite enables step-by-step implementation of the strategy. The main component is IBM Security QRadar SIEM.

IBM Security QRadar SIEM consolidates event data from log sources from thousands of endpoints and applications across the network. The solution performs instant normalization and correlation activities on raw data to distinguish true threats from false positives. Optionally, this software can also integrate IBM Security X-Force Threat Intelligence, providing a list of potentially destructive IP addresses, such as malware hosts, spam sources and other security threats. IBM Security QRadar SIEM also correlates system vulnerabilities with event and network data to help prioritize security breaches. IBM Security QRadar SIEM offers the following.

Benefits:

• Real-time visibility to detect and prioritize security threats and monitor the entire IT infrastructure

• Reduction and prioritization of alerts so that investigations can be focused on a reliable list of suspicious events

• Effektiveres Management von Sicherheitsbedrohungen bei gleichzeitiger Erstellung von detaillierten Berichten hinsichtlich Datenzugriff und Benutzeraktivitäten

• More effectively manage security threats while generating detailed reports regarding data access and user activityDeploy security data in cloud environments

• Generate detailed reports on data access and user activity for compliance management

SIEM is complemented by the other modules:

IBM Security QRadar Incident Forensics provides an optional IBM Security QRadar Packet Capture appliance for storing and managing data used by IBM Security QRadar Incident Forensics when no other network packet capture (PCAP) unit is deployed. Any number of these appliances can be installed for a network or subnet to capture raw packet data.

IBM Security QRadar QFlow Collector, combined with IBM Security QRadar SIEM and flow processors, provides Layer 7 application-level visibility and flow analysis so you can get a comprehensive picture of activity on your network and respond accordingly. This combined solution gives you more comprehensive visibility into network activity so you can better identify security threats, more easily comply with policies and regulatory requirements, and minimize risk to mission-critical services, data and assets.

IBM Security QRadar Log Manager is a high-performance system for capturing, analyzing, archiving and storing large volumes of network and security-related event logs. It analyzes data from network and security entities, servers and operating systems, applications, endpoints, etc. to provide near real-time insight into evolving security threats. IBM Security QRadar Log Manager can also help meet compliance monitoring and documentation requirements.

IBM Security QRadar VFlow Collector, combined with IBM Security QRadar SIEM, provides Layer 7 application-level visibility into virtual network traffic so you can get a comprehensive picture of activity on your network and respond accordingly. This combined solution supports VMware virtual environments to profile over 1,000 applications, better detect security threats, more easily comply with policies and regulations, and minimize risk to mission-critical services, data, and assets. It runs on the virtual server and requires no additional software.

IBM Security QRadar Vulnerability Manager proactively detects network entity and application vulnerabilities, adds context and helps prioritize remediation and risk mitigation actions. The solution is fully integrated with the IBM QRadar Security Intelligence Platform and prepares results from both scheduled and dynamic vulnerability scanning through network resource information, security configurations, expiration data, logs, and security risk information to keep vulnerabilities under control and enable compliance.

All modules are available with the first installation and are only additionally activated by license keys. Using the IBM QRadar Security Intelligence Platform minimizes training requirements and significantly reduces time to value. It provides vulnerability trend analysis, daily, weekly, and monthly views, automates compliance through collection, correlation, and reporting, and provides a comprehensive audit trail for compliance reporting.