IBM Security QRadar SOAR

We use IBM Security QRadar SOAR to automate and improve security operations.

• Help to respond fast to threats
• Easy to use
• Hard to implement

Splunk Enterprise

IBM Security QRadar SIEM, Splunk Enterprise Security (ES), Microsoft Defender for Business

The Python-based extensions for Orchestration & Automation are really important for me within IBM Security QRadar SOAR.

• With playbooks and automation you can achieve high ROI

HPE 3PAR StoreServ

HPE 3PAR StoreServ

We tried IBM suite for all threat detection and resolvece.

• Faster response time for any suspected threat and mitigation. Of course this is positive impact.
• If properly configured for automation, then it can save resources. Although, there is one time extensive resource utilization involved for initial setup.
• In some cases organisation might not utilise its full capabilities, in that case it is expensive.

Splunk Attack Analyzer, Palo Alto Networks Advanced Threat Prevention and Swimlane

Zoho BugTracker, Google Cloud AI, Google Cloud Platform, MongoDB

We use IBM Security QRadar SOAR to automate our process the incident response, so when the incident is generated on our SIEM IBM QRADAR, the SOAR collect the informations from offense and populate in an incident case, allow us to attach many artifacts to enrich our investigations and provide better visibility.

• Needs a developer team to automations
• Cause downtime for some bugs
• Is difficult to troubleshooting without IBM support team

Palo Alto Networks Cortex XSOAR

Splunk Enterprise Security (ES), Palo Alto Networks Cortex XDR

In our organization, we utilize IBM Security QRadar SOAR primarily for automating repetitive tasks to reduce the workload on analysts. It serves as a central hub for managing and orchestrating all security incidents. By enforcing predefined tasks and workflows, it streamlines incident response processes, ultimately enhancing our overall security posture.

• reducing time = less analysts = less pay
• companion ticketing systems in one place

Palo Alto Networks Cortex XSOAR, FortiSOAR and Microsoft Sentinel

LogRhythm NextGen SIEM Platform, Microsoft Sentinel