IBM i2 QRadar Offense Investigator: A New i2 Cyber Threat Hunting App

On June 20, the lives of cyberanalysts and threat hunters who use QRadar and IBM i2 Analyst’s Notebook are about to get a whole lot easier. A new app, IBM i2 QRadar Offense Investigator, enables QRadar users to push alerts and incident data directly to IBM i2 Analyst’s Notebook (version 9.0.6 or later) for in-depth visual analysis.

IBM i2 Analyst’s Notebook provides a rich, multidimensional visual analysis environment that empowers users to uncover hidden patterns and connections buried in disparate data sets. It features mathematical modeling that allows users to conduct temporal, histogram, geospatial and social network analysis across structured and unstructured data to uncover insightful trends about threats, threat actors and vulnerabilities.

By pushing QRadar network incident and alert data into i2 Analyst’s Notebook, IBM i2 QRadar Offense Investigator app users can proactively analyze that event data along with non-network data, such as HR, Dark Web and open source data. Combining these disparate data sets allows analysts to correlate seemingly unrelated events and details, creating a comprehensive understanding of the threat — and the threat actor — so they can quickly determine how to mitigate it.

Today’s determined cybercriminals will outsmart your security. Download the IBM i2 QRadar Offense Investigator app to put them on the defense.

Not yet an i2 user and want to experience the power of QRadar and i2? Visit the App Exchange and request a free evaluation license.

Watch the on-demand webinar to learn more about IBM i2 QRadar Offense Investigator

Bob Stasio

Global Offering Manager, IBM

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

Crisis communication: What NOT to do

4 min read - Read the 1st blog in this series, Cybersecurity crisis communication: What to doWhen an organization experiences a cyberattack, tensions are high, customers are concerned and the business is typically not operating at full capacity. Every move you make at this point makes a difference to your company’s future, and even a seemingly small mistake can cause permanent reputational damage.Because of the stress and many moving parts that are involved, businesses often fall short when it comes to communication in a crisis.…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

Hive0137 and AI-supplemented malware distribution

Unveiling the latest banking trojan threats in LATAM

Crisis communication: What NOT to do

Topic updates