QRadar & XGS: Stopping Attacks with a Click of the Mouse

© 2015 IBM Corporation
How IBM QRadar and XGS Work Together to Stop Threats
Craig Knapik
Technical Product Manager
IBM Security
Stopping Attacks with a Click of the Mouse

2© 2015 IBM Corporation
Abstract
As the tactics and techniques behind attacks continue to advance and evolve, organizations needs a faster
way to identify and prevent those attacks in real time. Learn how an integrated approach to security makes
this a reality, as highlighted by the bi-directional integration between IBM Security QRadar and IBM Security
Network Protection (XGS) – IBM’s next generation intrusion prevention system – that enables security
operators to block threats immediately with a click of a mouse.
Demonstration: https://www.youtube.com/watch?v=8ul82V50yqE

 IBM Threat Protection System
 IBM Security QRadar and IBM Security Network Protection Integration
 IBM Security QRadar and IBM Security Network Protection Configuration
 IBM Security QRadar and IBM Security Network Protection Operation
 Dynamic Patch Prioritization
 Why XGS?
 Questions
Agenda

IBM Threat Protection System
Smarter Prevention
Stop unknown threats with
behavioral-based defenses on
both the endpoint and network
Security Intelligence
Automatically detect weaknesses
and anomalies with enterprise-wide
visibility and insights
Continuous Response
Quickly understand incidents
and use findings to strengthen real-
time defenses
Open Integrations
Share context between domains
and third party products using
an open platform and ecosystem
A dynamic, integrated system to disrupt
the entire lifecycle of advanced attacks

IBM Threat Protection System

Examples of breaking the attack chain through integrated intelligence

 Why XGS?
 Questions
Agenda

IBM Security Network Protection (XGS)

QRadar SIEM correlates thousands of data sources in real time

XGS allows QRadar to see into SSL-encrypted traffic

XGS enterprise protection via QRadar quarantine

 Why XGS?
 Questions
Agenda

Standard deployment topology

XGS forwards network flow data to QRadar for behavioral analysis

XGS forwards security events and system events to QRadar

 Why XGS?
 Questions
Agenda

Case Action Scenario
Compromise Source IP is “right clicked” and
sent to XGS
Host infected with malware
Reputation Destination IP is “right clicked”
and sent to XGS
Malicious server, such as
malware host or command &
control server
Intrusion Source port “right clicked,” IP and
port combination sent to XGS
Client system attacking a
server
Exposure Destination port “right clicked,” IP
and port combination sent to XGS
Service has a vulnerability
The Security Analyst uses the QRadar console to effect quarantine . . .

Quarantine a compromised host

Quarantine an exposure or vulnerable service

 Why XGS?
 Questions
Agenda

QRadar Vulnerability Manager (QVM)

Dynamic Patch Prioritization

 Why XGS?
 Questions
Agenda

IBM positioned in the “Leaders” Quadrant in the 2015 Gartner Magic
Quadrant for Intrusion Prevention Systems

Resilient to Zero-Day Attacks

X-Force Top 100 Ahead of the Threat Coverage

Resilient to Mutated Exploits

Resilient to Obfuscated Exploits: XGS’ Efficacy (McAfee Evader nka
Semantic Gap Evasion)

Learn more about IBM Security Network Protection (XGS)
countries where IBM delivers
managed security services
industry analyst reports rank
IBM Security as a LEADER
enterprise security vendor
in total revenue
clients protected
including…
130+
25
No. 1
12K+
90% of the Fortune 100
companies
Visit the website
IBM Security Network Protection
Watch the videos
IBM Security Network Protection
Read new blog posts
SecurityIntelligence.com
Follow us on Twitter
@ibmsecurity
Join IBM X-Force Exchange
xforce.ibmcloud.com

Questions?

© Copyright IBM Corporation 2015. All rights reserved. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any
kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor
shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use
of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and / or
capabilities referenced in these materials may change at any time at IBM’s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product
or feature availability in any way. IBM, the IBM logo, and other IBM products and services are trademarks of the International Business Machines Corporation, in the United States, other countries
or both. Other company, product, or service names may be trademarks or service marks of others.
Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside
your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks
on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access.
IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other
systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE
IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.
THANK YOUwww.ibm.com/security

Information concerning non-IBM products was obtained from the suppliers of
those products, their published announcements or other publicly available
sources. IBM has not tested those products in connection with this publication
and cannot confirm the accuracy of performance, compatibility or any other
claims related to non-IBM products. Questions on the capabilities of non-IBM
products should be addressed to the suppliers of those products. IBM does not
warrant the quality of any third-party products, or the ability of any such third-
party products to interoperate with IBM’s products. IBM EXPRESSLY
DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED,
INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
The provision of the information contained herein is not intended to, and does
not, grant any right or license under any IBM patents, copyrights, trademarks or
other intellectual property right.
Other company, product, or service names may be trademarks or service
marks of others. A current list of IBM trademarks is available at “Copyright and
trademark information” www.ibm.com/legal/copytrade.shtml
Copyright © 2015 by International Business Machines Corporation (IBM). No
part of this document may be reproduced or transmitted in any form without
written permission from IBM.
U.S. Government Users Restricted Rights – Use, duplication or disclosure
restricted by GSA ADP Schedule Contract with IBM.
Information in these presentations (including information relating to products
that have not yet been announced by IBM) has been reviewed for accuracy as
of the date of initial publication and could include unintentional technical or
typographical errors. IBM shall have no responsibility to update this information.
THIS document is distributed "AS IS" without any warranty, either express or
implied. In no event shall IBM be liable for any damage arising from the use of
this information, including but not limited to, loss of data, business interruption,
loss of profit or loss of opportunity.
IBM products and services are warranted according to the terms and conditions
of the agreements under which they are provided.
Any statements regarding IBM’s future direction, intent or product plans are
subject to change or withdrawal without notice. Performance data contained
herein was generally obtained in a controlled, isolated environments. Customer
examples are presented as illustrations of how those customers have used IBM
products and the results they may have achieved. Actual performance, cost,
savings or other results in other operating environments may vary. References
in this document to IBM products, programs, or services does not imply that
IBM intends to make such products, programs or services available in all
countries in which IBM operates or does business.
Workshops, sessions and associated materials may have been prepared by
independent session speakers, and do not necessarily reflect the views of IBM.
All materials and discussions are provided for informational purposes only, and
are neither intended to, nor shall constitute legal or other guidance or advice to
any individual participant or their specific situation.
It is the customer’s responsibility to insure its own compliance with legal
requirements and to obtain advice of competent legal counsel as to the
identification and interpretation of any relevant laws and regulatory
requirements that may affect the customer’s business and any actions the
customer may need to take to comply with such laws. IBM does not provide
legal advice or represent or warrant that its services or products will ensure that
the customer is in compliance with any law.
Legal notices and disclaimers

QRadar & XGS: Stopping Attacks with a Click of the Mouse

More Related Content

What's hot

Viewers also liked

Similar to QRadar & XGS: Stopping Attacks with a Click of the Mouse

More from IBM Security

Recently uploaded

QRadar & XGS: Stopping Attacks with a Click of the Mouse