March 31, 2016 By Sandy Bird 3 min read

The process of developing actionable security intelligence requires gathering multiple insights regarding the identity, methods and motivation of the attacker and the device or technique used to breach an organization’s defenses. Just one data point makes for bad guesses, kind of like the early play in the classic board game Clue.

In the game of Clue, there are six characters, six murder weapons and nine rooms, leaving the players with 324 possibilities of who did what and where it happened. The permutations for security incidents are a bit higher, but then again, nobody used a computer for the board game. Nevertheless, the point is that the more data you collect, the better the odds are that you’ll guess correctly and solve the mystery.

Using Sense Analytics to Solve the Puzzle

IBM Security QRadar powered by the Sense Analytics Engine helps security teams focus their defensive efforts on the most damaging conditions by reducing the number of variables at play.

From the moment it’s installed, QRadar begins building intelligence using mathematical models, observations, network scans and external vulnerability and threat intelligence feeds. It stores this information within itself to help refine the real-time processing of security data. It also eliminates false positives (the guesses) by knowing that it couldn’t have been Miss Scarlet — because she has limited access credentials to critical data and never visits malicious websites. Colonel Mustard, however, clicks on any link that strikes his fancy.

The Benefits of QRadar

The presence of new devices is automatically sensed to create asset and user profiles that highlight the presence of risks, vulnerabilities and linkages to contextual pieces of information. Application traffic is also tracked and the packets deeply inspected.

Sensitive data is monitored and tracked to detect movement outside the norm in volume, time of day or the account accessing it. Issues or exposures associated with any one of these activities may or may not indicate an attack, but the value of QRadar rests in its ability to associate three, four or five related incidents involving the same IP or MAC address, email or chat IDs, etc. to surface a high-probability offense. This is something multiple-point solutions simply can’t do.

Learn More About QRadar Sense Analytics

The real-time analysis and stored intelligence capability of QRadar helps restrict and qualify data so correlation rules are triggered by only a particularly relevant subset of the data, helping speed execution. Security teams can build their own indicators of compromise (IoC) lists or import them from an external service.

It’s similar to what humans do when using sight, sound and smell, combined with instincts and memories, to put a dinner together but avoid buying items from a food recall list. This multivariant processing capability of QRadar is something we refer to as sense analytics, which is the engine driving our security intelligence results.

Integrating Security Solutions

Sense analytics and security intelligence work best if you can cover the complete environment made up of endpoints, network, cloud resources and applications. This eliminates the blind spots — kind of like visiting all the rooms in Clue’s Tudor mansion.

The QRadar platform is available in an easy-to-deploy appliance, managed services or even a SaaS offering, depending on how the customer wants to consume it or if additional skills are needed to help with investigations. Clients realize value within days. Adding more data collection or distributed processing capability is a simple task that’s accomplished, in most cases, without the help of a professional services engagement.

IBM Security QRadar powered by Sense Analytics is the solution you need to solve the mystery. Its ability to collect multiple insights or clues will help your teams focus on the highest probability security scenarios. They can more quickly identify who the attackers were, what technique they used and where the initial breach occurred. If you were playing Clue, it’s like taking the fast lane to open the envelope and confirm that it was Mr. Green in the library with the candlestick.

Learn More About QRadar Sense Analytics

More from Intelligence & Analytics

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

11 min read - IBM X-Force has identified new capabilities in DBatLoader malware samples delivered in recent email campaigns, signaling a heightened risk of infection from commodity malware families associated with DBatLoader activity. X-Force has observed nearly two dozen email campaigns since late June leveraging the updated DBatLoader loader to deliver payloads such as Remcos, Warzone, Formbook, and AgentTesla. DBatLoader malware has been used since 2020 by cybercriminals to install commodity malware remote access Trojans (RATs) and infostealers, primarily via malicious spam (malspam). DBatLoader…

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable of keylogging, collecting system information, and deploying secondary payloads. Imitating official correspondence from the Russian government in phishing emails aligns with previous Hive0117 campaigns delivering DarkWatchman malware, and shows a possible significant effort to induce a sense of urgency as…

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today