QRadar SIEM and FireEye MPS Integration March 2014 1
IBM QRadar Security Intelligence Platform Providing actionable intelligence INTELLIGENT Correlation, analysis and massive data reduction AUTOMATED Driving simplicity and accelerating time-to-value IBM QRadar Security Intelligence Platform INTEGRATED Unified architecture delivered in a single console 2
Security intelligence timeline and definition What are the major risks and vulnerabilities? Are we configured to protect against advanced threats? What security incidents are happening right now? What was the impact to the organization? Vulnerability Pre-Exploit Exploit Post-Exploit Remediation PREDICTION / PREVENTION PHASE Gain visibility over the organization s security posture and identity security gaps Detect deviations from the norm that indicate early warnings of APTs Prioritize vulnerabilities to optimize remediation processes and close critical exposures before exploit REACTION / REMEDIATION PHASE Automatically detect threats with prioritized workflow to quickly analyze impact Gather full situational awareness through advanced security analytics Perform forensic investigation reducing time to find root-cause; use results to drive faster remediation Security Intelligence The actionable information derived from the analysis of security-relevant data available to an organization 3
QRadar SIEM: Command console for Security Intelligence Provides full visibility and actionable insight to protect against advanced threats Adds network flow capture and analysis for deep application insight Employs sophisticated correlation of events, flows, assets, topologies, vulnerabilities and external data to identify & prioritize threats Contains workflow management to fully track threats and ensure resolution Uses scalable hardware, software and virtual appliance architecture to support the largest deployments 4
Embedded intelligence offers automated offense identification Extensive Data Sources Security devices Servers and mainframes Network and virtual activity Data activity Application activity Configuration information Vulnerabilities and threats Users and identities Global threat intelligence Automated Offense Identification Massive data reduction Automated data collection, asset discovery and profiling Automated, real-time, and integrated analytics Activity baselining and anomaly detection Out-of-the box rules and templates Embedded Intelligence Prioritized Incidents Suspected Incidents 5
QRadar SIEM: Benefits Reduce the risk and severity of security breaches Remediate security incidents quickly and thoroughly Ensure regulatory and internal policy compliance Reduce manual effort of security intelligence operations 6
IBM/Q1 Labs in SIEM Leadership Quadrant for Fifth Straight Year Magic Quadrant for Security Information and Event Management, Gartner, 7 May 2013 Gartner Magic Quadrant for SIEM: IBM/Q1 Labs SIEM is rated #1 for on Ability to Execute (the Y-axis) and beat McAfee/Nitro, RSA, LogRhythm, and Splunk on Completeness of Vision (the X-axis) Ability to execute is an assessment of overall viability, product service, customer experience, market responsiveness, product track record, sales execution, operations, and marketing execution. Completeness of Vision is a rating of product strategy, innovation, market understanding, geographic strategy, and other factors What Gartner is Saying about IBM/Q1 Labs: QRadar is a good fit for midsize and large enterprises that need general SIEM capabilities and also for use cases that require behavior analysis and NetFlow analysis. Behavioral analysis is recognized by Gartner as essential in the detection of advanced threats. Customer feedback indicates that the technology is relatively straightforward to deploy and maintain across a wide range of deployment scales. A distinguishing characteristic of the technology is the collection and processing of NetFlow data, deep packet inspection (DPI) and behavior analysis for all supported event sources. 7
QRadar & FireEye MPS Events coming in 8
QRadar SIEM: Product Tour - the Intelligence of Offense Management QRadar SIEM reduces millions of events and flow records to the top few threats and incidents called Offenses Through correlation with contextual data (events, flows, vulnerabilities, threat intelligence feeds) Rules engine creates an offense as a response to a sequence of events, behavior, Incident Response Teams and Security Administrators rely on Offenses to determine what they need to remediate or investigate. 9
QRadar SIEM: Product Tour - the Intelligence of Offense Management There is a dashboard widget for the Top Offenses Offense tab shows offenses currently open, with drill down to details 10
QRadar SIEM: Product Tour of Intelligent Offense Scoring QRadar judges magnitude of offenses: Credibility: A false positive or true positive? Severity: Alarm level contrasted with target vulnerability Relevance: Priority according to asset or network value Priorities can change over time based on situational awareness 11
QRadar SIEM: Product Tour of Offense Tab 12
QRadar SIEM: Offense triggers as a result of FireEye events What was the breach? Who was responsible? Was it successful? How many targets involved? How valuable are the targets to the business? Are any of them vulnerable? 13
Where is all the evidence? 14
QRadar SIEM: Use Cases QRadar SIEM excels at the most challenging use cases: Complex threat detection Malicious activity identification User activity monitoring Compliance monitoring Fraud detection and data loss prevention 15
QRadar SIEM & FireEye Use Cases 1. ID Attacker FireEye is on the inside network; it has no idea who the outside IP address is. Leveraging our data gathering ability, QRadar SIEM will provide the real IP address of the threat, lookup the system domain and name. IPS and flow information can tell if that source is active in any other ways and XForce threat feed will tell if the source is a known threat. 2. ID an attack and prevent it from propagating When FireEye finds an attempt to attack a vulnerability, QRadar and QVM/QRM can immediately see what other critical systems are vulnerable to that active attack and prioritize the immediate patching or blocking to those systems. 16
QRadar SIEM & Zscaler Use Cases 3. Web Exploit detected FireEye MPS sends QRadar events that indicate a virus has been detected followed by a browser being infected. QRadar generates and offense that indicates which other hosts in the organization have been infected by the virus and which web servers were the source of the attack. The incident response team can focus on cleaning the organization s most valued assets first and modify their policy to prevent future contact with the webserver. 17