QRadar Advisor with Watson

Click roadmap title to expand/collapse roadmap

QRadar Advisor with Watson Roadmap

The total time required to complete this roadmap is 8h 15m.

This roadmap outlines fundamental courses intended for someone who works with IBM QRadar Advisor with Watson. These courses introduce you to cognitive analytics and the QRadar Advisor architecture and deployment models and help you to deploy QRadar Advisor into your overall QRadar environment.


Overview

Review the following courses to learn about QRadar Advisor concepts and architecture and how to use the cognitive analytics capabilities for your threat investigations.


QRadar preparation

Before you install and configure QRadar Advisor with Watson, you must tune your QRadar deployment to leverage the QRadar Advisor analytic capabilities in the best way.


Setup and installation

During the installation process, you must address specific critical configuration parameters to make your QRadar Advisor as efficient as possible.


Configure QRadar Advisor with Watson

Once QRadar Advisor is installed, you can leverage certain features to improve your experience with the application.


Investigations

In this learning path, we present examples of how you can best leverage QRadar Advisor's potential during your investigations.


Incorporating third party threat intelligence in QRadar Advisor with Watson
NEW

In this video, you will learn about the benefits of setting up and using third-party threat intelligence data in IBM Security QRadar Advisor with Watson.

Utilizing log sources in QRadar Advisor with Watson

In this video, we talk about why log sources are important to IBM Security QRadar Advisor with Watson. We show examples of one investigation with a configured L2R log source and another one without.

Custom Event Properties in QRadar Advisor with Watson

In this video, you learn why mapping Custom Event Properties is important to QRadar Advisor with Watson and how to do it inside the configuration utility.

Utilizing Assets and Network Hierarchy in QRadar Advisor with Watson

In this video, you learn how proper Asset and Network Hierarchy configuration can improve your IBM Security QRadar Advisor with Watson investigations.

Tuning and best practices for QRadar Advisor with Watson

In this video, you learn about QRadar Advisor with Watson tuning and best practices. The course covers the following topics:

  • Preparing QRadar by tuning offenses
  • Why data sources matter?
  • Importance of the Network Hierarchy
  • Automatic Investigations
  • Local Threat Intelligence
  • False Positives
  • Preparing QRadar by tuning offenses
  • Why data sources matter
  • Importance of the Network Hierarchy 
  • Automatic Investigations 
  • Local Threat Intelligence 
  • False Positives

Automatic Investigations in QRadar Advisor with Watson

In this video, you will learn about the benefits of setting up automatic investigations in IBM Security QRadar Advisor with Watson.

QRadar Advisor with Watson - Investigation and Analysis

In this four-part video, we explain how QRadar Advisor with Watson can empower Security Analysts by reducing critical time for investigations and at the same time enriching the findings using the information discovered by Watson.

The first video describes three different investigation methods using QRadar Advisor:

  • Manual
  • Automatic
  • Re-Investigation.
The second video covers the Watson tab in the QRadar console by exploring the three analytical stages that can be used with QRadar Advisor with Watson:
  • Local
  • Watson Insights
  • Expanded Local Context
The third video demonstrates how to use the Watson knowledge graph, and shows details related to malware execution and blocking. The video also explains the export feature and covers the STIX standard.

Finally, a real-world use case demonstration of a user related investigation shows how QRadar Advisor with Watson is being used to shorten the investigation and response times when it really matters.

Installing QRadar Advisor with Watson 2.5.3

This video demonstrates how to install QRadar Advisor with Watson and how to perform the initial setup.

The video covers the prerequisites you need for the app and all the settings that are relevant to the new configuration.


QRadar Advisor with Watson - Technical deep dive

In this four-part course you learn the fundamental details of QRadar Advisor with Watson.

The first video provides background information about cognitive computing and Artificial Intelligence (AI), and how QRadar Advisor with Watson fits into that space. Then the video explains how IBM Watson is used in cyber security and, specifically, in QRadar.

The second video explains typical responsibilities of the security analyst job role. Then, it explains how those security analysts can use QRadar Advisor with Watson to assist them in their threat analysis and investigation.

The third video describes standard terminology and the individual components of QRadar Advisor with Watson, and how they can be utilized.

Finally, a real-world use case demonstration of a user related investigation shows how QRadar Advisor with Watson is being used to shorten the investigation and response times when it really matters.

A SOC analyst’s perspective on QRadar Advisor with Watson

In this course, Jeremy Begley looks at the QRadar offense investigation from a SOC analyst perspective while utilizing QRadar Advisor with Watson.

Strengthening Security with Cognitive Analytics

Artificial intelligence (AI) is changing the future of cybersecurity. Security professionals need to mine not only structured information but also unstructured data, including human-generated content. Artificial intelligence enables IT teams to reason, learn and provide a context in real time beyond simple analytics patterns.

Armed with this collective insight, security analysts can respond to threats with increased speed, accuracy and confidence.

Mark Brosnan, Mary O’Brien, Anthony O’Callaghan and Ronan Murphy discuss how to stay ahead of the game in today’s rapidly evolving landscape.

This Panel Discussion about "Strengthening Security With Cognitive Analytics And Intelligent Integration" has been recorded at the Zero Day Con 2017, and it is reproduced here with the permission of ZDC, February 2018.

What's new in QRadar Advisor with Watson V2

QRadar Advisor with Watson helps you automate your repetitive SOC tasks while gaining actionable insights into critical incidents faster and to adopt a quicker and more decisive escalation process. 

Version 2 allows you to align incidents with the MITRE ATT&CK chain and utilize cross-investigation analytics. Through analysis of the local environment, QRadar Advisor V2 recommends, which new investigations should be escalated to assist an analyst with driving quicker and more decisive escalations.