Not only does IBM Security QRadar SIEM record log events, such as user logins or VPN connections, but it also records flow data—network activity that can last for seconds to days, such as a streaming a movie. This unique ability helps QRadar SIEM provide comprehensive visibility across your security and cybersecurity environments, including on-premises data centers, clouds, SaaS applications and employee endpoints, to limit blind spots where malicious activity could be hiding.
You can extend your QRadar SIEM threat detection capabilities even further with multiple integration points such as device support modules (DSM), network behavior collection devices, threat intelligence feeds and vulnerability scanners.
Access more than 450 device support modules (DSM) and more than 370 applications
Threats move fast. Unlike other SIEM solutions on the market, QRadar SIEM automatically parses and normalizes a log source’s event into standard taxonomy format. To do this, QRadar SIEM autodetects more than 450 DSM modules, from Amazon to Zscaler, that are ready for use with the installation of QRadar and supported by IBM.
QRadar SIEM accepts events from log sources by using protocols such as syslog, syslog-tcp, and SNMP. QRadar SIEM can also set up outbound connections to retrieve events by using protocols such as SCP, SFTP, FTP, JDBC, Check Point OPSEC, and SMB/CIFS.
Guard your network with network behavior collection devices
QRadar SIEM can receive flows from many different types of network data sources, or flow sources, classified as either internal or external. This provides a deeper view into your network to help eliminate blind spots.
The following external flow protocols are supported:
Identify and prioritize threats quickly
Integrations with vulnerability data help QRadar SIEM understand more about the assets in your environment to prioritize alerts and reduce false positives. Additionally, vulnerability assessment scanners can provide vulnerability assessment profiles for network assets.
Get ahead of emerging worldwide threats
For additional context to prioritize threats, QRadar SIEM uses integrations with threat intelligence feeds and vulnerability scanners. Threat intelligence feeds provide QRadar SIEM current information on the latest threats discovered around the world, so you can proactively take action to guard your environment.
Build your own integrations
If there isn’t already integration support for a system in your environment, QRadar SIEM allows you to create a custom parser for your data source. You can also collect events from various REST APIs for less common data sources that do not have a specific DSM or protocol by using the QRadar SIEM Universal Cloud Rest API.
Event data represents log events that occur at a single point in time in a user’s environment, such as user logins, email, VPN connections, firewall denials, proxy connections and more.
Flow data is network activity information or session information between two hosts on a network. QRadar SIEM translates or normalizes the raw data from IP addresses, ports, byte and packet counts, and other information into flow records. In addition to collecting basic flow information, full packet capture is available with the QRadar Network Insights (QNI) component available on QRadar SIEM.
A key difference between event and flow data is the time period each data type is able to represent. An event occurs at a specific time and the event is logged at that time. A flow is network activity between two hosts that can last for seconds, minutes, hours or days depending on the activity within the session. For example, a web request that downloads multiple files such as images, ads and video that lasts for 5 to 10 seconds, or a user who watches a movie with a streaming service.
QRadar SIEM gives your security analysts a complete view from the beginning, middle and end of an event.
If you would like more information on IBM QRadar, contact us today!
NDM Technologies © 1994 - Present | Website Developed & Managed by C. CREATIVE, LLC