Integrating AI into Threat Management

When we look at the challenges surrounding threat management, one that stands out is the prioritization of security alerts. In the process of threat management, we have terabytes of data being analyzed in our local environments and it creates hundreds of security alerts. It is impossible to fully understand the impact of all of these security alerts as well as to prioritize which alerts should be dealt with first in a timely manner. Statistically, it has often taken days to find out a breach has happened, and substantial additional time after that to contain it.

Per IBM’s Data Breach Report from 2022, it takes about 277 days on average to identify and stop a data breach. From a security point of view, such a delay in detection and resolution can cause irreversible damage to the organization. So, as the volumes of data and security alerts have increased, so too has the technology become more mature. The introduction of Artificial Intelligence...

QRadar Assistant app – a quick overview

The QRadar Assistant app gets installed when you install QRadar. This app works like an assistant that suggests and manages all the apps and extensions in QRadar.

The QRadar Assistant app is primarily used to download and install other apps and extensions. For this to happen, if your QRadar appliance is behind a firewall, you will need to access the internet via a proxy. There are different URLs to which you will need to allow access via the firewall. The QRadar Assistant app comes with the Phone Home facility. This app scans through QRadar and will inform you if there are any issues found. No personally identifiable data is collected in this process. By default, you are opted out of this feature. If you choose to opt in, some basic information including offense data, version details, log sources, notifications, and health scores will be shared with IBM.

If there are any privacy concerns, the Assistant app can also be run in offline...

QRadar Advisor with Watson

QRAW is based on Watson’s cognitive intelligence. IBM Watson uses information from varied sources, breaks it into data points, and then uses the security domain knowledge to stitch together all the data points related to a certain parameter. For example, let’s say there is a known hash value for a certain malware, and that hash value is present in the event details in QRadar. IBM Watson uses this information to create graphs and correlations to explain which assets are affected by malware, how this malware entered the organization, how it proliferates or moves laterally, and so on. It also shows the assets and users involved. This kind of detailed analysis is done by QRAW in a matter of minutes. It would have taken SOC analysts weeks or months to get all this information.

QRAW uses Watson’s cognitive intelligence. Let us look at how QRAW works with QRadar with the help of the following flow chart:

Figure...

QRadar Use Case Manager app

While working with QRadar, you might have noticed the enormity of data and the number of rules that a QRadar administrator must work with. The sheer number of rules that come out of the box with the system, and the rules added when new apps and extensions are installed, can be overwhelming. On top of that, some organizations need customized alerts for which custom rules must be created. Managing these rules is a challenge. As we learned in earlier chapters, enabling all the rules is counterproductive and will adversely affect QRadar performance. So how do you manage QRadar rules? The QRadar Use Case Manager app is designed to manage QRadar rules and optimize them. We will look at both these functionalities.

Before we discuss this app in detail, let us understand what the MITRE ATT&CK framework is and how it is used by the QRadar Use Case Manager app.

MITRE ATT&CK is a framework designed for security analysts, threat hunters, red/blue teams...

Summary

In this chapter, we examined three QRadar apps: namely, the QRadar Assistant app, QRAW, and the QRadar Use Case Manager app. QRadar apps are designed to make it easier to edit, tune, and understand QRadar features. In all, applying artificial intelligence to solve real-life security issues is possible using QRAW. The Use Case Manager app helps you understand and improve the security posture of your organization via a bird’s-eye view, along with easy navigation to understand and tune QRadar rules. You should now be capable of using all three apps in your QRadar deployment.

In the next chapter, we will touch on more QRadar applications that are both easy to use and provide a great ROI for the time invested.