IBM Security QRadar SOAR

Our whole organization's security is managed by IBM Security QRadar SOAR, we have defined alerts within the application so whenever an alert is triggered, it automatically investigates the problem and provides us with a document containing the time and location where it happened and ip address and url if available and some few other data. And ever since we started using IBM Security QRadar SOAR, our organisation had a better ROI as unlike IBM SEIM, it not only raises an alert but also automatically starts the investigation process.

We are using the solution for network & security needs. For SOC side, we use the power of IBM Security QRadar SOAR to enrich alerts, prioritize alerts and correlate incidents. This helps us present related alerts in a unified dashboard thus reduces noise and saves us time.
Other than presenting alerts, the automated playbooks approach to trigger actions regarding the output of the playbook, such as blocking an IP address on your DDoS device, quarantining a file hash on your firewall or your ips device, blocking spam/malicious domains on your email security device and automating many of the daily tasks to ensure and enhance security has never been easier.
The most important issue at anywhere is manpower at the moment and with IBM Security QRadar SOAR, while we reduce MTTR to alerts, we also reduced the required manpower and manual labor which is a win-win on the long run.

We use IBM Security QRadar SOAR as our primary SIEM tool. We injust logs from various other system and tools to gather intelligence and custom alerting. We use an MSSP service to leverage this data for threat intelligence and hunting.

We have deployed IBM resilient SOAR to ensure optimum security in our network and systems. It has a robust capability to detect camouflaged threats easily and rapidly. It identifies threats in order of how much damage a threat can cause to our systems. Its AI-powered threat intelligence tracks the most consequential threats. Once a threat has been picked out, it provides automated cognizance of the root cause. It has been helpful in making sure we have a smooth workflow through its instant alerts whenever a threat is detected.

In our organization (Healthcare Recovery Department) we have been using this application for the past two years. Ee replaced a tool called HPBSM which creates the incidence when the application is having an outage. To Replace the HPBSM we came to the tool of IBM Resilient Incident Response. IBM Resilient is used in our recovery application which is created in the net for increasing/classifying the severities of incidents and notifying IT in the event of an outage or cyber attacks caused. lt is also used by the IT team to classify the incidents and take measurable action on time when threats or outages happen.