Course Catalog

This video series demonstrates integration between IBM MaaS360 and IBM QRadar SIEM. It includes the following demonstrations:

• MaaS360 and QRadar Integration overview
  
• Sending MaaS360 events to QRadar SIEM
  
• Installing the MaaS360 app
  
• Using QRadar Action Script with MaaS360 API

Prerequisites: This video series assumes that you have the following skills:

• Basic knowledge of QRadar SIEM concepts
• Basic knowledge of the MaaS360 portal
• Basic knowledge of Python scripting

For more information about these topics, visit the QRadar SIEM and MaaS360 roadmaps in the Security Learning Academy.

This course includes two technical demonstrations that highlight how Carbon Black Response and IBM QRadar SIEM integrate to quickly detect, respond, and remediate live security incidents. This integration is part of the long standing strategic partnership between Carbon Black and IBM.

This course consists of a set of videos related to basic LDAP topics. The course is focused on IBM Security Directory Server, but the concepts are applicable to any LDAP v3 compliant directory. You learn about LDAP suffixes, directory information tree, object classes and attributes. The videos demonstrate basic LDAP commands: search, add, modify and delete. The video also explains concept of LDIF flies.

Overview

• Part 1 demonstrates the integration of QRadar Advisor with Watson with Resilient functionality. QRadar with Watson provides artificial intelligence to automatically investigate and provide insights to threat indicators and related entities. Integration with Resilient allows the security analyst to automatically track and enrich incident artifacts and reporting.
• Part 2 demonstrates how to use Resilient as a workflow automation tool to enhance the analyst's ability to manage the response to the more complex threats that require more than the actions allowed directly from within QRadar.

The MITRE ATT&CK Framework is a globally-accessible knowledge base of advisory tactics and techniques based on real-world observations.

The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and services community.

This video provides and overview of the MITRE ATT&CK Framework, followed by a discussion of how IBM Resilient and other IBM Security products use MITRE ATT&CK with a live demonstration and a Q&A.

This lab demonstrates bidirectional integration of IBM® QRadar® SIEM and IBM® Guardium®.  QRadar SIEM collects the logs from various devices in enterprise networks.  The logs are received through connectors called Device Support Module (DSM).  QRadar has a DSM for Guardium. That DSM enables QRadar to receive and process logs from Guardium.

Alternatively, Guardium has an API that provides an option for QRadar to react to certain events detected by QRadar, and send Guardium those commands to adjust the database policy to properly react to the event.  For example, if QRadar detects that the source IP from an internal network is communicating with an IP address classified as the Botnet Server, it can send a command to Guardium to block any access to the database from the same IP address.  The call from QRadar to Guardium can be done using the Custom Actions feature of QRadar or using IBM Security Directory Integrator® (IDI) that acts as the proxy; transforming various events from QRadar into Guardium API calls.

This IDI solution uses custom developed code that IBM provides as-is without any support and maintenance commitments. You can download the code from the Security Learning Academy in the Additional Resources section of this course.

This course teaches you how to take advantage of the information posted in IBM X-Force Exchange (XFE) platform by using the API, curl tool, and python language.

The course also demonstrates integration between XFE and QRadar SIEM using XFE SDK and direct integration or Threat Intelligence Application and TAXII endpoints.

Objectives

• Learn how to leverage the X-Force Exchange API, curl tool, and python scripts to pull threat data from the X-Force Exchange platform
• Install the Threat Intelligence app in QRadar SIEM
• Test the API using online documentation
• Use curl commands and the X-Force Exchange API documentation to simulate browser requests
  
• Write a python script that uses X-Force Exchange API code
• Use TAXII feeds, collections, and the QRadar Threat Intelligence app to integrate the X-Force Exchange API and QRadar SIEM
• Configure threat data feeds to monitor and detect ransomware outbreaks

Experts from the IBM Resilient and QRadar Support teams show the SOC analyst how to safely and effectively troubleshoot their Resilient integration with QRadar when issues arise. This video is a recording of a live Open Mic web seminar originally broadcast on 29-July-2020.

Agenda:

• How to enable debug and retrieve logs
• Checking connectivity
• How to read the logs
• Using the IBM QRadar API
• Common errors
• Opening a case, what next?
• Questions for the panel

Duration: 26minutes

This video presented by Jose Bravo discusses a technique to use Guardium Data Encryption and QRadar to help protect against ransomware.

This course demonstrates integration between IBM Security Secret Server and IBM Security QRadar SIEM. You use Secret Server to manage privileged user account activity, which is reported to QRadar in syslog events.

In the course demonstration, syslog CEF logging is enabled in Secret Server, and QRadar is configured to parse and normalize the events that are received from Secret Server. As part of the course, a custom content extension is provided, which contains over 170 mapped events from the Secret Server. In addition, the extension has one custom rule, two reference sets, two custom search queries, and one log source type named SecretServer_SLA.
The purpose of this custom extension is to show how Secret Server can help you investigate some critical activities.

In this video, Jose Bravo demonstrates the value that Cloud Pak for Security (CP4S) brings to a QRadar environment. Jose will demonstrate an attack on a Windows system and how QRadar recognizes an offense has occurred and triggers CP4S to take automated remedial action.

This lab focuses on the integration of IBM Security Resilient SOAR Platform and IBM Security QRadar SIEM products.
The IBM QRadar SIEM solution helps you monitor and detect security threats. Based on the QRadar correlation rule engine (CRE), the product can generate offenses that require the attention of a security analyst.

Some of the topics covered in the lab are:

• Install QRadar app for Resilient
• Configure QRadar app for Resilient
• Customize the Resilient configuration
  
• Customize the Jinja templates
• Configure Custom Actions and synchronization
• Install QRadar functions for Resilient
• Create table with artifacts by using the QRadar functions
• Create action to search QRadar for file hashes from a log source
  
• Test the apps integration and customization using the QRadar offenses

This video is a recording of the Resilient and QRadar Integration Open Mic web seminar originally broadcast on 17-November-2020.

Agenda

• Part 1: IBM Resilient (SOAR) QRadar Integration App
• Installation
• Configuration (JINJA template)
• AQL Attachment
• Syncing notes and offenses status
• Part 2: QRadar Functions for Resilient
• Installation of the Functions (AppHost)
• Examples and demonstration of functions, workflows, rules, and actions that extract the data from QRadar
• QRadar AQL Search
• Questions & Answers

IBM Security Guardium is a data security and data privacy solution that helps ensure the integrity of data that is stored on servers. Guardium uses policies to monitor data servers and act when it detects suspicious database activity, such as:

• Failed logins
• Unauthorized access
• SQL Error codes such as SQL injection attacks
• Users trying to escalate their privileges
• Users trying to indirectly access sensitive data

The Guardium S-TAP agent monitors the data servers that host the sensitive data and report database activity to a Guardium Collector. The Guardium Collector applies policies to the database activity. When a policy rule is triggered, the Guardium Collector can use the system log to send an alert to IBM Security QRadar security information and event management (SIEM). QRadar receives the alert through a connector, which is called the Guardium device support module (DSM), and displays it in a console. 

In this lab, you integrate Guardium and QRadar to display an event in the QRadar SIEM console when a suspicious user attempts to read or manipulate sensitive data.

Watch a replay of the Tech Day exploring not only the individual components and capabilities of Guardium and QRadar, but also how the two can integrate to refine visibility and understanding of data security threats and boost cross-security collaboration and response.