IBM QRadar SIEM Consulting for a Large Aerospace Entity
Summary
A large aerospace entity's IBM Security QRadar SIEM was not delivering a sufficient level of security, and the organization began considering other SIEM options. Instead of a costly replacement, INNERLUXES applied its proprietary SIEM health-check tool to quickly diagnose the existing deployment, surface its performance issues, and recommend concrete fixes — boosting ROI from the current SIEM installation and increasing customer satisfaction.
About the Client
The Client is a large aerospace entity.
The Challenge
With vast volumes of sensitive data at its disposal, the Client had opted for IBM Security QRadar SIEM, expecting it to provide real-time analysis of log data and network flows to prevent malicious activity. As the deployed QRadar solution wasn't able to ensure a sufficient level of security, the Client at one point started to consider other SIEM options.
The Solution
INNERLUXES offered a quick-fix solution that helped boost ROI from the existing SIEM installation and increase customer satisfaction.
The Client adopted INNERLUXES's proprietary SIEM health-check tool — an automated monitoring solution that provides a comprehensive view of an organization's SIEM, letting security specialists detect operational deviations and data losses and troubleshoot them promptly. With 37 performance metrics and 25 health markers, the tool supports efficient QRadar SIEM performance, and its distinctive features include Data Quality Validation and Offense Analysis.
The existing QRadar deployment experienced a number of performance issues, which the tool immediately identified. Based on the health-check report, INNERLUXES's security specialists proposed solutions to the system's performance issues:
| Performance issue | Solution |
|---|---|
| Event Processor host overload | Hardware upgrade / log sources audit tuning |
| License limit excess | License upgrade / log sources audit tuning |
| Significant number of false positives from out-of-the-box correlation rules | Fine-tuning correlation rules |
| Outdated Protocol and DSM | Manual installation of Protocol and DSM updates |
The Results
- Armed with the SIEM health-check tool, the Client's security team is implementing a series of measures based on the tool's reports.
- The approach boosted ROI from the existing IBM QRadar SIEM installation and increased customer satisfaction.
Technologies and Tools
INNERLUXES's proprietary SIEM health-check tool for IBM Security QRadar SIEM.