Build cost effective Security Data Lake + SIEM
0 likes672 views
The document discusses building a cost-effective security data lake using IBM QRadar. It defines a data lake and security incident and event management (SIEM). Organizations choose data lakes for search/hunting and SIEM for detecting malware/anomalies. IBM QRadar's Data Store enables efficient data mining by collecting and storing log data separately from security analytics data, while still allowing the data to be accessed for reporting, visualization, and custom applications. This provides a security data lake capability within QRadar without additional cost or vendors.
Build cost effective Security Data Lake + SIEM
- 1. Future of cyber security www.rasoolirfan.com Build cost effective Security Data Lake
- 2. Future of cyber security www.rasoolirfan.com Definitions “A data lake is a method of storing data within a system or repository, in its natural format, that facilitates the collocation of data in various schemata and structural forms, usually object blobs or files. The idea of data lake is to have a single store of all data in the enterprise ranging from raw data (which implies exact copy of source system data) to transformed data which is used for various tasks including reporting, visualization, analytics and machine learning.” ~Wikipedia Security incident and event management (SIEM) is the process of identifying, monitoring, recording and analyzing security events or incidents within a real-time IT environment. It provides a comprehensive and centralized view of the security scenario of an IT infrastructure ~Techopedia Data Lake SIEM
- 3. Future of cyber security www.rasoolirfan.com Why organization choose Data Lake or SIEM Rationale Data Lake SIEM Purpose Reason Technology Expertise Search, hunting Detecting malware, anomalies, offenses Less Capex; Log Management; Investigations Better Correlation & Detection capabilities Open source Commercial Experts Dependent Out of box Product features
- 4. Future of cyber security www.rasoolirfan.com How IBM QRadar help achieve customer achieve both Data Lake & SIEM Answer - QRadar Data Store to enable efficient data mining for security and compliance use cases QRadar Data Store has a predictable pricing model based on the number of hosts that store data, and customers can optionally add as much storage and compute power as needed. Data Store is configured using a simple collection filter in QRadar. By selecting the data source, or the event criteria from the data source, you can easily define which data is sent directly to Data Store Data Store is a QRadar licensing overlay that leverages existing storage and processing capacity on Event Processors and Data Nodes to collect, process and store data identified for Data Store Data Store is primarily used for log management, so its data is excluded from correlation and advanced security analytics capabilities. However, Data Store data can be used by most other capabilities, such as searching, reporting, visualization and custom apps built using the QRadar App Framework. Data Store data cannot be used for historical correlation. However, the filtering policy that separates Data Store data from SIEM data can easily be changed. As soon as the policy is updated, all future data collected will be included in all analytics and correlation processes within QRadar Because Data Store data does not go through analysis or correlation, analytics-driven apps may not be able to fully leverage data collected using Data Store. All other capabilities, such as reporting, parsing, custom properties and dashboards, should work as expected. Leverage the QRadar SDK to build custom apps and analytics on top of your data to address a variety of unique security and IT operations use cases Provide security teams with massive volumes of data to which they can pose a variety of questions via Ariel Query Language and easily filter through results. Share data between Security and IT Ops. Centralize enterprise-wide data for reporting and analytics, and control access to data based on data type and user role.
- 5. Future of cyber security www.rasoolirfan.com Now, you can build a security data lake without breaking your budget or adding another vendor to your security stack https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/t_qradar_adm_data_store.html