IBM adds a strong dose of automation and AI to its QRadar platform

More than a decade after IBM first got hold of the QRadar network intelligence technology, it is now being expanded with a massive update that aims to provide a unified experience for managing security.

The original technology behind QRadar, was acquired by IBM via the 2011 acquisition of Q1 Labs, which had developed security information and event management (SIEM) technologies. The new QRadar Security Suite goes beyond the SIEM and aims to help organizations manage extended detection and response (EDR/ XDR), (SIEM) and  Security Orchestration Automation and Response (SOAR) cybersecurity capabilities.

As part of the unified security experience, IBM is also adding artificial intelligence (AI) into the platform to help manage and prioritize threat alerts.  The new platform also benefits from automated threat investigation that will provide analysts with details on risk as well as recommended actions for remediation.

"The new IBM Security QRadar Suite is our next -generation threat detection and response portfolio, which is an expansion and evolution of both existing products and new innovations being introduced," Chris Meenan, vice president, product management, IBM Security, told SDxCentral. "It builds on IBM investments and acquisitions in this space over the last decade, including existing products for SIEM, SOAR and EDR."

There's a lot to unpack inside of the QRadar Suite as it integrates a number of technologies.

At the foundation level, is the QRadar SIEM, which IBM has been iterating on since 2011. SOAR capabilities come from the acquisition of Resilient in 2016 and EDR capabilities from IBM's acquisition of ReaQta in 2021. Beyond the assets that IBM gained via acquisition, Meenan said that QRadar Suite also includes a new cloud-native log management and security observability product called QRadar Log Insights.

Meenan added that the suite also features a new modernized user interface that cuts across all products in the suite, embedded with AI and automation innovations to speed security analyst response.

"What differentiates the new QRadar Suite portfolio from our existing products is that they are being delivered initially as SaaS on AWS," Meenan said. "All products in the suite feature a new, modernized unified analyst experience which was built to improve security analyst speed efficiency with less switching between screens and tools, including third-party ones."

As part of the unified analyst workflow in the QRadar Suite, IBM is integrating an AI-powered automated investigation capability called Threat Investigator.

Meenan said that Threat Investigator takes a lot of the manual effort out of alert investigation by automatically data mining back into various security systems. The system looks at the source of the alert for indicators of compromise, such as lateral movement or command and control, and brings those insights back to the analyst in a visual format for rapid consumption, and includes recommended automated response actions to mitigate the threat quickly.

Going a step further, Meenan said that there are a wide variety of AI and automation capabilities within both the individual products in the suite.

"We’ve narrowed in on the AI applications that we see having the greatest impact on SOC speed and efficiency, and are embedding those automatically throughout the portfolio and within the analyst user interface that cuts across our tools," he said.

With the QRadar Suite IBM is bringing together EDR/XDR, SIEM and SOAR which helped to create a new superset of capabilities.

Meenan said that within the new QRadar Suite IBM has specific EDR/XDR, SIEM and SOAR products, each of which contain specific capabilities that are designed to address certain customer needs and outcomes.

"Ultimately, all of these capabilities grouped together in a unified suite are increasingly referred to as Threat Detection, Investigation and Response (TDIR)," he said. "Importantly the new QRadar Suite is completely modular, so customers can start with whatever product they want, and enable additional products as and when they need, essentially appearing as new features in the unified analyst experience. "