Closing the breach window, from data to action

Accelerate threat detection and response (TDR) using AI-powered centralized log management and security observability

It is not news to most that cyberattacks have become easier to launch and harder to stop as attackers have gotten smarter and faster. For those defending against cyberthreats, things continue to get more complicated. The list of challenges is long: cloud attack surface sprawl, complex application environments, information overload from disparate tools, noise from false positives and low-risk events, just to name a few. The burden is further exacerbated for the many organizations that struggle with overstretched cyberteams, manual processes, and a chronic cybersecurity skills gap.

The average cost of a data breach set a new record in 2023 of USD 4.45 million, and the IBM X-Force Threat Intelligence Index revealed a threat landscape with a predominance of extortion-motivated attacks and signs of increased collaboration between cybercriminal groups. On the bright side, data also shows that artificial intelligence (AI) and automation can improve security readiness and speed response to attacks, to help dramatically shrink the data breach window before causing real harm.

Greater visibility and speed are core requirements for effective cybersecurity. Security leaders must proactively address the expanding attack surface and bolster their threat detection and response (TDR) strategy to significantly reduce the risk of costly data breaches.

A pragmatic approach to security operations is long overdue

Now, more than ever, security observability and threat detection and response workflows require purpose-built solutions designed for cloud scale and automation.

Over the years, an overwhelming surplus of security-related data and alerts from the rapidly expanding cloud digital footprint has put an enormous load on security solutions that need greater scalability, speed and efficiency than ever before. Legacy systems and architectures led to unsustainable costs of data ingestion, analysis, and storage, as well as performance issues when searching and analyzing threats across massive datasets.

A modern log management platform, optimized for security and compliance use cases, can be vital to modernizing security operations, improving security readiness and reducing risk in a more cost-effective way. This pragmatic approach can be the right measure for organizations:

• Looking for a scalable and cost-efficient solution to meet compliance and foundational threat detection and investigation needs,
• Lacking the staff and expertise to use and benefit from more complex security solutions, such as SIEMs,
• Needing faster and more efficient search of huge datasets across disparate data sources in order to better support threat hunting and analytics requirements.

Log management and observability for the modern SOC is finally here

IBM Security QRadar Log Insights is a log management and security observability platform that is AI-powered and purpose-built to meet the needs of modern security operations in a simple and cost-effective manner. Delivered as a service on AWS and available on AWS Marketplace as a built-in solution with quick onboarding and multiple integrations for fast time to value. Some examples include AWS IAM Identity Center, AWS Control Tower, and AWS Cloud Trail.

With QRadar Log Insights, SOC teams gain near real-time visibility into the organization’s digital footprint and respond fast empowered by:

• New Unified Analyst Experience (UAX) across clouds and on-premises,
• Extended threat hunting with “ingestionless” federated search and embedded expertise,
• Cloud-scale ingestion to pull all the data you need into one place,
• Sub-second search speeds for faster threat hunting and analysis,
• High-fidelity findings and insightful visualizations for efficient investigations.

Key use cases

Accelerate TDR with AI-powered unified analyst experience (UAX)

QRadar Log Insights provides a simplified and unified analyst experience so your security operations team can visualize and perform analytics using all your security-related data, regardless of the location or the type of data source. For instance, while investigating an incident, you can run a single search, at lightning speed, that checks for indicators of comprise (IoCs) and runs analytics on both your ingested data and data gathered by third-party tools in other clouds or on-premises. See some common sources in the screenshot below.

UAX provides a common interface and open language to access all security intelligence and collaborate with your team and community peers.

Capabilities included in QRadar Log Insights UAX:

• Automated machine learning-based risk prioritization,
• Self-learning noise reduction from past actions,
• AI-powered automated investigation with built-in threat intelligence and recommended actions,
• Sub-second search and analysis of large datasets,
• Federated search that enables “ingestionless” threat search across disparate and third-party data sources,
• End-to-end case management throughout the entire threat lifecycle, and
• MITRE ATT&CK mapping that shows the attack from an adversarial intent perspective.

In stark contrast with existing workflows, UAX provides a real gain in analyst productiveness, particularly with a large impact on organizations’ ability to fight threats. See below for an example of how much faster analysts can work with UAX.

Enable powerful threat hunting with embedded expertise

QRadar Log Insights’ UAX embedded intelligence and automation saves SOC teams significant time, which allows these teams to focus on higher-value tasks, such as proactive threat hunting.

Threat hunting is provided with Kestrel,  an open source threat hunting language that integrates lightning-fast federated search, threat intelligence, and analytics all in one engine. 

A visual builder simplifies the hunting experience with a library of command templates and in-context explanations and examples.

QRadar Log Insights’ AI model acts as a security analyst who knows exactly what to hunt for. The attack-path view shows which hosts and assets have been impacted, while the network activity view shows if data has leaked and lateral movement has happened where malicious actions have taken place.

When zero-days or attack campaigns rise, QRadar Log Insight provides a quick “Am I Affected” assessment of impact with timely IBM X-Force Threat Intelligence, closing skill gaps that could favor attackers when time matters the most. If you would like to know more about the “Am I Affected” feature and use cases, check out how to Detect MOVEit Transfer Zero-Day with QRadar Log Insights.

Hunting playbooks can be created by threat hunting experts and saved for use by less experienced analysts. Integrated case management for identified threats helps streamline the collection of attack evidence and artifacts and keeps track of all response tasks.

With QRadar Log Insights, your team can easily develop threat hunting skills, identify threats that elude existing defenses, analyze the techniques being used, and strengthen protection against existing and emerging threats.

Get a fast track to clarity: Single view with near real-time visibility and interactive dashboards

QRadar Log Insights uses a modern open-source OLAP data warehouse, ClickHouse, which ingests, automatically indexes, searches and analyzes large datasets at sub-second speed. You get near real-time visibility and insights from your ingested data.

QRadar Log Insights rapidly ingests, analyzes and presents data in interactive, built-in dashboards designed by cybersecurity experts. The underlying search queries and source data is available at a click for deeper inspection. Its Kusto query language (KQL) is human-readable and intuitive, requiring no prior training.

Dashboards are fully customizable and come with a widget library and Grafana plugin for frictionless visualization of full-stack data across teams.

Manage security and compliance costs

Managing cost has become a top priority for any organization. The explosive growth of data used for security is resulting in unsustainable storage cost of legacy solutions. This is especially true for organizations in regulated markets that must retain data for longer periods of time to meet compliance requirements. To help meet such a wide range of storage needs and requirements, QRadar Log Insights supports hot, warm and cold storage.  With flexible retention options, organizations can optimize data storage and better manage their costs.

Working faster and smarter is the only true option

With QRadar Log Insights, you can modernize the SOC, better manage cost, close the skills gap, increase analyst productivity, and reduce risk with accelerated threat detection and response. Experience how easily and fast you can identify, investigate and mitigate threats in this click-through demo of QRadar Log Insights.

Explore QRadar Log Insights

To learn more, visit the QRadar Log Insights page for information on the QRadar suite of security products.

The post Closing the breach window, from data to action appeared first on IBM Blog.