QRadar Advisor with Watson
QRAW is based on Watson’s cognitive intelligence. IBM Watson uses information from varied sources, breaks it into data points, and then uses the security domain knowledge to stitch together all the data points related to a certain parameter. For example, let’s say there is a known hash value for a certain malware, and that hash value is present in the event details in QRadar. IBM Watson uses this information to create graphs and correlations to explain which assets are affected by malware, how this malware entered the organization, how it proliferates or moves laterally, and so on. It also shows the assets and users involved. This kind of detailed analysis is done by QRAW in a matter of minutes. It would have taken SOC analysts weeks or months to get all this information.
QRAW uses Watson’s cognitive intelligence. Let us look at how QRAW works with QRadar with the help of the following flow chart:
Figure...
