Picture this: You’re all set to go and have a big day ahead of you, but you can’t find the car keys. Frustrating, right? So is trying to find phishing attacks, lateral movement, embedded malware and advanced threats buried deep within normal traffic as they traverse your network. It’s hard to find what you can’t see.

Network Insights From a Curious Toddler

My wife recently reminded me about the time her keys went missing as we packed up the house for a big move. Imagine a house full of boxes, everything properly labeled and organized, but no keys. They had to be there somewhere: They were on the counter earlier in the day and nobody had come or gone. We lost count of how many boxes we opened before we eventually hit the jackpot. The keys were in a box, sitting just inside a handhold opening. Apparently, it was the work of a curious toddler — clever little guy.

Clearly, one of the biggest challenges in our key search was visibility. Labels on the outside of the boxes were of no help. It’s similar to a challenge we face every day as security analysts. Full packet capture is a powerful tool to secure the critical information crossing our networks every second. Here we’re dealing with packets, not cardboard boxes. But what if we had the ability to analyze not only the metadata, but also the content, in real time? It would be like the moment we discovered the keys hanging in the box.

Deep Network Visibility

IBM QRadar Network Insights addresses the need for deep network visibility. Similar to packet capture, this solution taps the network to inspect 100 percent of transmitted data. Instead of storing it, however, it focuses on conducting deep analysis in real time. Packet data is reassembled and sessions reconstructed and thoroughly analyzed to provide not only traditional flow information, but much deeper insights into both network activity and layer 7 applications.

The tool detects content that would otherwise pass through our networks unnoticed. This analysis is capable of intrinsic detection as well as the extraction of key data, which allows IBM QRadar to provide new levels of threat detection and reduce the rate of false positives.

Watch the on-demand webinar: Expose Threats in Real-time with IBM QRadar Network Insights

Beyond Detection

QRadar enables analysts to look deep into an email to see who is being phished, whether someone responded or whether an innocent-looking file contains embedded scripts or other indications of hidden malware. They can tell if a series of disjointed, external emails or files is discretely exfiltrating valuable data piece by piece.

This goes beyond just detection — it gives analysts the data to search for past occurrences, hunt for subtle indicators of threat activity and reconstruct the full packet capture data with IBM QRadar Incident Forensics to finally reveal the complete picture.

Now that’s powerful. If only missing keys were that easy to find.