IBM Security QRadar

What is IBM QRadar?

IBM QRadar is a SIEM system (Security Information and Event Management) - it collects logs from entire IT infrastructure (firewalls, servers, AD, cloud), analyzes them and detects suspicious behavior. When it detects an attack - it alerts SOC or responds automatically.

SIEM + SOAR in one:

• QRadar SIEM - collects logs, correlates events, detects attacks
• QRadar SOAR - automates response (playbooks), manages incidents

What is it for?

• Detecting attacks (ransomware, phishing, insider threats)
• Compliance (NIS2 requires logging and monitoring)
• Incident analysis (what happened, when, who)
• SOC automation (less manual work)

How does SIEM work?

1. Log Collection

QRadar collects logs from entire infrastructure:

[Firewall] ----\
[Active Directory] ----+---- [QRadar SIEM] ---- [SOC Analyst]
[Linux Servers] ----+                              |
[AWS/Azure] ----/                            [Alerts/Reports]

Data sources:

• Firewalls (Fortinet, Check Point)
• Active Directory (logins, permission changes)
• Servers (Windows Event Log, Linux syslog)
• Cloud (AWS CloudTrail, Azure AD, Microsoft 365)
• Endpoints (EDR, antivirus)
• Applications (SAP, databases)

2. Correlation and Detection

QRadar analyzes millions of events and looks for patterns:

Attack example:

1. 08:00 - Failed AD login (user “john.smith”)
2. 08:01 - 50 failed logins from same IP
3. 08:05 - Successful login from different country
4. 08:10 - Large file download

QRadar: “This looks like brute-force + account takeover” → Alert to SOC with full timeline

3. AI Reduces Noise

Typical SIEM generates thousands of alerts daily. 70% are false positives.

QRadar AI:

• UEBA (User Entity Behavior Analytics) - learns normal user behavior
• Risk scoring - prioritizes alerts by risk
• Automatic enrichment - adds context (threat intelligence, geolocation)

Effect: 90% fewer false positives, SOC focuses on real threats.

How does SOAR work?

SOAR (Security Orchestration, Automation and Response) automates incident response:

Playbooks

Defined response procedures:

Example “Phishing” playbook:

1. Alert: “Suspicious email with attachment”
2. Automatically: Download attachment to sandbox
3. Automatically: Check sender reputation
4. Automatically: Check if anyone clicked link
5. If malware: Block sender, remove email from all mailboxes
6. Create ticket for SOC with full analysis

Without SOAR: Analyst does this manually - 30-60 minutes With SOAR: Automatically - 2-5 minutes

Integrations (300+)

SOAR connects with your tools:

• Firewalls - blocking IP
• AD - disabling accounts
• EDR - endpoint isolation
• Ticketing - creating incidents
• Email - removing messages

QRadar Components

Component	What it does	When you need it
QRadar SIEM	Log collection, correlation, detection	Always - this is the foundation
QRadar SOAR	Response automation, playbooks	When you have SOC and want to automate
QRadar Log Insights	Cloud-native log management	Large volumes, cloud
QRadar EDR	Endpoint protection	When you don’t have EDR (CrowdStrike, Defender)

QRadar vs Competition

Feature	IBM QRadar	Splunk	Microsoft Sentinel
Pricing model	Per EPS (predictable)	Per GB (can grow)	Per GB (can grow)
SOAR built-in	Yes	Splunk SOAR separate	Separate product
AI/ML	UEBA built-in	ML Toolkit separate	Built-in
On-premises	Yes	Yes	Cloud only
Integrations	500+	2000+	200+ (mainly Microsoft)

When QRadar?

• Predictable budget (no surprises with log growth)
• Need on-premises (regulations, air-gap)
• Want SIEM + SOAR from one vendor
• Already have IBM (Power, FlashSystem)

Who is it for?

QRadar makes sense when:

• You have SOC (Security Operations Center) or planning one
• Must meet NIS2/DORA (logging and monitoring requirement)
• Have more than 500 users / complex infrastructure
• Want to detect advanced attacks (not just viruses)

QRadar doesn’t make sense when:

• Small company <100 people - better managed SOC
• No dedicated security - nobody will respond to alerts
• Everything in Microsoft 365 - Sentinel might suffice

How much does it cost?

QRadar has per EPS (Events Per Second) licensing:

Size	EPS	Approximate annual price
Small	1,000	~$25K
Medium	5,000	~$75K
Large	25,000	~$200K

Additionally:

• SOAR - separate license per user/playbook
• Hardware/VM - if on-premises
• Implementation and tuning - typically $12-35K

Specifications

Deployment	Appliance, VM, Cloud, SaaS
Integrations	500+ out-of-box
Capacity	Up to millions EPS
Retention	Configurable (typically 90-365 days)
Compliance	NIS2, DORA, GDPR, PCI DSS, SOX

FAQ

How does QRadar differ from Splunk? QRadar is SIEM+SOAR in one, license per EPS (predictable). Splunk is mainly log management, license per GB (can grow unpredictably).

What is EPS? Events Per Second - how many events/logs system processes per second. 1000 EPS is ~86 million events daily.

Does QRadar replace antivirus? No. QRadar analyzes logs from antivirus (and 100 other sources). Antivirus/EDR still needed on endpoints.

What is UEBA? User Entity Behavior Analytics - AI learns how users normally work and alerts on anomalies (e.g., “John usually logs in from Warsaw, today from Russia”).

Do I need SOAR? SOAR makes sense when you have repeatable response procedures and want to automate them. For small SOC (2-3 people) - SIEM is enough to start.

How long does implementation take? Basic SIEM: 4-8 weeks. With SOAR and playbooks: 2-4 months. Tuning (reducing false positives): additional months.

Will QRadar detect ransomware? Yes - through correlation (mass file encryption, C2 connections). But this doesn’t replace EDR on endpoints.

Does nFlo implement QRadar? Yes. SIEM/SOAR implementations, creating correlation rules, playbooks, integrations, tuning.

How to start? Workshop with nFlo - we analyze log sources, compliance requirements, select license and plan implementation.