We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

IBM makes QRadar security event management product more intelligent

IBM is widely expanding the intelligence gathering functions available to its security-event management (SEM) product, QRadar Security Intelligence Platform, as well as designing a virtual-appliance version of it that works on the VMware platform.

QRadar, which IBM gained in its acquisition of Q1 Labs last fall, can already receive and correlate information based on 400 sources of security data. Now it will also take in the IBM X-Force feeds of real-time threat intelligence, providing both a dashboard view to security managers as well as allowing them to set up a SEM rule to trigger alerts based on the information.

By later this spring, QRadar will be also outfitted to take in threat information from IBM's database protection product, Guardium, as well as link to the IBM Identity and Access Management product and IBM Endpoint Manager. Plus, IBM is adding support in modules for third-party products, including Symantec DLP, Websense Triton, Stonesoft's Softgate.

BACKGROUND: IBM software eases role-based security operations

This is going to enable new types of SEM threat monitoring of corporate network activity, says Phil Neray, vice president of security intelligence strategy at IBM's security systems division.

"With more context and data sources, like IBM Identity and Access Management, QRadar can look up a role, saying this is not consistent with what they're doing," he says, pointing out this could be the basis for an alert of suspicious activity. In another scenario, QRadar could detect records flowing out from an internal corporate database across the network and going to a known Internet hot spot, and that event could be flagged immediately with an alert.

In addition to expanding QRadar's capabilities to synthesize information through a larger source of threat intelligence, IBM is creating a virtual-appliance version of QRadar that would work in the VMware ESX environment — though not yet for the vSphere cloud computing platform.

These additions are being rolled out in the Q2 timeframe; QRadar starts at $50,000.

Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security.

Read more about wide area network in Network World's Wide Area Network section.

IDG UK Sites

Best Black Friday 2014 tech deals: Get bargains on smartphones, tablets, laptops and more

IDG UK Sites

What the Internet of Things will look like in 2015: homes will get smarter, people might get fitter

IDG UK Sites

See how Trunk's animated ad helped Ade Edmondson plug The Car Buying Service

IDG UK Sites

Yosemite tips: Complete Guide to OS X Yosemite