Harmonise your security processes with orchestrated Incident Response services

Multiply your team’s effectiveness 

40x faster overall response using dynamic playbooks that orchestrate your people, process and technology

IBM Resilient managed incident response platform integrates with all existing security systems to create a single hub for Incident Response, allowing easy workflow configuration and process automation to transform an organisation’s security posture. It empowers security teams to analyse, respond, resolve and mitigate incidents faster using consistent, intelligent processes.

One customer went from 20 days (on average) to close a security incident to less than 5 days – this was IBM.

The life of a security incident

Although there is strong integration between QRadar and Resilient, the infographic below on the life of a security incident is applicable to any SIEM.

For a suspected malware outbreak and based on QRadar rules, an incident is automatically created inside the IBM Resilient platform, importing relevant information about the attack and any indicators of compromise (IoCs). Resilient will then generate a detailed response plan specific to the incident type and attaches any associated IOCs like the malware hash.

Leveraging automatic enrichment capabilities, the suspected malware is compared against threat intelligence feeds like IBM X-Force Exchange which confirms it is known bad malware and other characteristics such as linked phishing attacks and associated source IP addresses. These details can then be used to orchestrate remediation, like blocking the attack source through FW changes, helping to tune the SIEM tool to be more effective.

With IBM Resilient, you can:

• Empower your security team to analyse, respond to, and mitigate cybersecurity incident faster and more effectively.
• Achieve greater intelligence and efficiency by integrating your existing security technologies, including SIEMs, EDR, threat intelligence, and more.
• Adapt to real-time incident conditions with Resilient Dynamic Playbooks – ensuring a fast and complete response to all incident types.
• Harmonise your security processes with orchestrated incident response services

Resilient’s Dynamic Playbooks share several critical and differentiating attributes:

• Agile: continually react to changes by leveraging rules and scripts that implement business logic and enriching incidents as they progress.
• Intelligent: leverage information from other connected systems to make rules-based decisions to take actions – such as increasing incident priority or escalating to other parts of the organisation (HR, legal). By the time an analyst opens an incident, many repetitive, initial triage steps have already been completed.
• Sophisticated: keep business rules separate from workflows, eliminating the need for a proliferation of static playbooks with only slight variations and keeping management overhead to a minimum. As an example as to how this works, consider a spear-phishing attack on a work laptop used by a senior executive. Before a SOC analyst even sees the incident, rules and conditions associated with the Dynamic Playbook have used information from connected systems to determine that the user is an executive, automatically escalated the alert to tier-2 analysts, raised the official severity code for the incident and notified the company’s legal team.

In addition, Resilient’s Dynamic Playbooks support integrations with more than 100 other systems that may be present in a typical security environment, providing clients with a seamless, centralised incident response hub.

Orchestrated Response: A game-changing strategy

An orchestration strategy allows for security teams to process incidents faster and more accurately. And by automating repetitive and menial tasks and delivering the right information to the right analyst at the right time, orchestration can significantly drive down Mean-Time-To-Response.

Click here to read more