QRadar XDR - IBM Documentation

11/21/22, 5:18 PM QRadar XDR - IBM Documentation
QRadar XDR
Last Updated: 2022-11-17
With IBM QRadar XDR you can predict, prevent, and respond to current threats. QRadar XDR is an
open extended detection and response (XDR) ecosystem that integrates NDR, SIEM, UBA, SOAR
and Threat Intelligence, while leaving data where it is, for a holistic approach.
The QRadar XDR offering includes the following applications.
For more information about QRadar XDR applications and stand-alone applications that can be
included with the Cloud Pak for Security offering, see Licensing and entitlement.
Case Management
IBM® Security QRadar® SOAR Case Management provides organizations with the ability to track,
manage, and resolve cybersecurity incidents. With Case Management, security and IT teams can
collaborate across their organization to rapidly and successfully respond to incidents. Case
Management is a subset of IBM Security QRadar SOAR and is available without an extra license
on IBM Cloud Pak for Security. For more information, see SOAR.
Data Explorer
IBM Security Data Explorer enables you to conduct federated search and investigation across your
hybrid, multi-cloud environment in a single interface and workflow. Use Data Explorer to complete
investigations in a timely manner without compromising visibility. Core underlying services and
capabilities include the following features.
Federated data search to unite silos of security data and provide complete visibility; across security
solutions, for example, Security Information and Event Management (SIEM), Endpoint Detection
and Response, Data lake), and across cloud infrastructures, such as Azure, Amazon Web Services
(AWS).
Single, unified interface and workflow to investigate threats and Indicators of Compromise into user-
selected data sources
In-context data enhancements from Connected Assets and Risk data sources and IBM Security
Threat Intelligence Insights
Workflows to track, append, create security cases from the native platform case management
system.
For more information, see Data Explorer.

https://www.ibm.com/docs/en/cloud-paks/cp-security/1.10?topic=overview-qradar-xdr 1/4
Detection and Response Center (Beta)

IBM Detection and Response Center (Beta) provides a unified overview of your organization's security
posture through use cases from different security tools and platforms, saving you hours of gathering
the same insights by using individual tools.
The Beta version supports rules and use cases from IBM QRadar and the Sigma Community. Sigma
rules, which are enhanced by STIX patterns, are used by Threat Investigator in its investigations. You
can also run the STIX patterns in Data Explorer.
Core elements of the Beta version include the following features.

Exploring rules through visualization and reports
Running STIX patterns from Sigma rules in Data Explorer
Visualizing threat coverage across the MITRE ATT&CK framework
For more information, see Exploring security rule use cases with Detection and Response Center
(Beta).
Orchestration & Automation

IBM Security QRadar SOAR Orchestration & Automation requires a license and is available as an
application that is fully integrated in IBM Cloud Pak for Security.
Orchestration & Automation provides the following benefits:
Create response plans that are based on industry standards and best practices.
Integrate more easily with security and IT tools, and orchestrate responses to events and incidents.
Collaborate across the organization, equipping various stakeholders with the tools to fulfill their roles
and tasks as part of an incident response effort.
The application that is integrated on Cloud Pak for Security provides most, but not all, of the stand-
alone IBM Security QRadar SOAR feature set. For more information about this application,
see SOAR.
If you have an Orchestration & Automation license, you can choose between the application on Cloud
Pak for Security or the stand-alone version on a virtual appliance. The stand-alone virtual appliance
version provides the full feature set of IBM Security QRadar SOAR. For more information, see IBM
Security QRadar SOAR .
QRadar SIEM and NDR

IBM QRadar is offered as an on-premises solution that delivers intelligent security analytics, enabling
visibility, detection, and investigation for a wide range of known and unknown threats. Event analytics
ingest, parse, normalize, correlate, and analyze log and event data to detect indicators of threats.
Event analytics also identify anomalous activities, automatically connect related threat activity, and
alert security teams to potential threats. Flow analytics collect, extract, and normalize valuable
network flow data and packet metadata to augment log-based security insights. Flow analytics also
identify network and application level threat activity, such as phishing, lateral movement, and data
exfiltration.
IBM Cloud Pak for Security includes entitlement to QRadar Security Intelligence Platform.
Important: Red Hat® OpenShift® is not a prerequisite for the installation of this
stand-alone solution.
For more information about downloading, installing, and using QRadar Security Intelligence Platform,
see QRadar documentation.
QRadar User Behavior Analytics

IBM QRadar® User Behavior Analytics is a tool for detecting insider threats in your organization.
Connection to the IBM QRadar on-premises solution by the QRadar Proxy service is a prerequisite.
User Behavior Analytics, used with the existing data in your QRadar system, can help you generate
new insights around users and user risk. For more information, see User Behavior Analytics.
Threat Intelligence Insights

IBM Security Threat Intelligence Insights is an application that delivers unique, actionable, and timely
threat intelligence. The application provides almost all of the functions that IBM X-Force®
Exchange provides.
IBM-derived threat intelligence that crosses threat activity, threat groups, malware, and industries.
Continuous and automated Am I Affected searches that cross connected data sources to
proactively identify your most relevant threats.
Analytical and adaptive threat-scoring to help prioritize threats for further investigation and
response.
For more information, see Selecting your Threat Intelligence Insights plan and Threat Intelligence
Insights.
Threat Investigator
IBM Security Threat Investigator automatically analyzes and investigates cases to help you make
more informed decisions. By showing potential threats and the assets that are impacted, Threat
Investigator can help determine the criticality of exposure, how many systems are at risk, and the level
of remediation effort that is required. By viewing the historical timeline of threats within your
organization, you can better understand dwell times and the stage of the threat.

QRadar XDR - IBM Documentation

Uploaded by

Copyright:

Available Formats

QRadar XDR - IBM Documentation

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

QRadar XDR - IBM Documentation

Uploaded by

Copyright:

Available Formats

11/21/22, 5:18 PM QRadar XDR - IBM Documentation

The QRadar XDR offering includes the following applications.

For more information, see Data Explorer.

Detection and Response Center (Beta)

Core elements of the Beta version include the following features.

Orchestration & Automation

Orchestration & Automation provides the following benefits:

QRadar SIEM and NDR

QRadar User Behavior Analytics

Threat Intelligence Insights

You might also like