Becamex QRadar Presentation IBM Qradar SIEM.pptx

IBM Qradar SIEM

1. IBM QRadar SIEM Becamex Do Nhat Tan - HPT Cyber Security

2. Solution overview Product Demo Deployment & sizing 1 2 3 Contents HPT competency 4

3. Solution oveview 1

4. The importance of event logs

5. Challenges without SIEM No long term storage Disparate information Lack of correlation

6. What is SIEM? Security Information and Event Management Collects events Detects threats Alerts to SOC Search & investigate

7. SIEM in regulations International: NIST, PCI DSS, HIPAA, FISMA, GDPR, ISO 27000... Vietnam: TT 09-NHNN, NĐ 85-CP...

8. SIEM functions Collects and parses events Correlates and alerts Dashboards for monitoring Escalates incident Compliance

9. SIEM requirements Variety in protocols Automation Data enrichment Compress and index Distributed processing Open platform

10. IBM QRadar SIEM

11. QRadar SIEM Integrated, Intelligence and Automation Collect : Multiple type of informations logs, flows, configurations, vulnerabilities and threat intelligence Analysis : Multiple built-in engine and rules (CRE and ADE), integration with cognitive (Watson Advisor) Response : Security incidents detection and response, continous monitoring, compliance reports IBM QRadar SIEM

12. Interop & customize Open platform : Single collaboration platform for rapidly delivery new apps and contents (UBA) Theat and risk management : Risk from pre-exploit (VM) and post-exploit (SIEM & IRP) with cognitive Out-of-Box rules & reports : Built-in many rules & reports, and updates from AppExchange QRadar Capabilities

13. QRadar Capabilities Data parsing & normalization

14. QRadar Capabilities Data collection: supports many protocols 71 protocols 381 log source types Custom log source types

15. QRadar Capabilities Searching & investigation

16. QRadar Capabilities Dashboards

17. QRadar Capabilities Deep flow visibility with QNI Session reconstruction and application analysis Extraction of key metadata and content Full payload and application content analysis QRadar Network Insights Real-time analysis of network traffic Intrinsic Suspect Content detection

18. QRadar Capabilities Response & automation

19. QRadar Capabilities Compliance

20. QRadar Capabilities Compression and indexing

21. QRadar Capabilities Enrichment and CTI integration

22. QRadar Capabilities AI based investigation enrichment with Watson

23. QRadar Capabilities DNS Analyzer

24. QRadar Capabilities Machine learning based User Behavior Analysis

25. QRadar Capabilities SOAR integration Prioritized incidents Incident identification Extensive data collection, storage, and analysis Real-time correlation and threat intelligence Automatic asset, service and user discovery and profiling Activity baselining and anomaly detection Embedded Intelligence QRadar Sense Analytics Servers and mainframes Data activity Network and virtual activity Application activity Configuration information Security devices Users and identities Vulnerabilities and threats Global threat intelligence EXTENSIVE DATA SOURCES

26. QRadar Capabilities Distributed processing

27. Product Demo 2

28. Demo highlights Monitoring with dasboards Basic SIEM functionalities: Parsing (DSM & custom), normalization Searching & investigating Correlation Asset & vulnerability management Threat Intelligence Incident Response integration

29. Deployment & sizing 3

30. QRadar Components

31. Expansion with data node

32. QRadar distributed processing

33. QRadar Communications QRadar All-in-one appliance

34. QRadar Appliances Appliance (M6) Max EPS Max FPM CPU RAM HDD xx01 Event Collector 1201 30,000 1xSilver 4216 16C 64G 2.4TB (4x0.6) 10K Raid10 Flow Collector 1501 xx05 Event Processor 1605 20,000 2xSilver 4210 10C 64G 12TB (10x1.2) 7.2K Raid6 Flow Processor 1705 1,200,000 Both Processor 1805 5,000 200,000 AIO 3105 5,000 200,000 xx29 Event Processor 1629 40,000 2xSilver 4214 12C 256G 96TB (12x8) 7.2K Raid6 Flow Processor 1729 2,400,000 Both Processor 1829 15,000 300,000 AIO 3129 15,000 300,000 xx48 Event Processor 1648 80,000 2xGold 6230 20C 22MB 256G 24TB (6x3.84) SSD Raid6 Flow Processor 1748 3,600,000 Both Processor 1848 30,000 1,200,000 AIO 3148 30,000 1,200,000

35. QRadar storage sizing Typical data disk: 25TB Type Data rate Space required per day (GB ) Days / store (GB) Free 20 % (GB) Data HDD (GB) Records Payloads EPS 3,500 21 17 365 15,048 18,810 23,513 FPM 15,000 0.3 0.1 30 158 198 248

36. QRadar Licensing   Part Number Part Description IBM QRadar Base License   D1RNCLL IBM QRadar Software Install License   D1RS8LL IBM QRadar Disaster Recovery Software Install License QRadar SW Node License   D1S2JLL IBM QRadar Software Node Install License   D1RS0LL IBM QRadar High Availability Software Install License - HA EPS Capacity Upgrade   D1RP3LL IBM QRadar Event Capacity 2.5K Events Per Second License   D1RNXLL IBM QRadar Event Capacity 1K Events Per Second License   D1RNRLL IBM QRadar Event Capacity 500 Events Per Second License   D1RNKLL IBM QRadar Event Capacity 100 Events per Second License FPM Capacity Upgrade   D1RQALL IBM QRadar Flows Capacity 10K Flows Per Minute License   D1RQMLL IBM QRadar Flows Capacity 50K Flows Per Minute License   D1RQTLL IBM QRadar Flows Capacity 100K Flows Per Minute License

37. HPT Competency 4

38. Staff capabilities First QRadar project: 2014 QRadar experts: 04 Skills Consultant & design Implementation Maintain, support & troubleshoot Healthcheck & optimize

39. Project experience BFSI : Foreign : Industry :

40. Q&A

41. Thank You!