IBM builds on Q1 Labs acquisition with QRadar boost

gallery

IBM has issued the first major update of the security information and event management (SIEM) software it bought in its Q1 Labs acquisition, claiming it is blowing the competition out of the water with the amount of data feeds it has collated.

Big Blue said the QRadar Security Intelligence Platform, built mainly of Q1 Labs sauce rather than IBM’s own code, draws together 400 sources on threats giving IT pros a wider knowledge of dangers facing their networks.

IBM has hooked up its own X-Force threat feed to the SIEM offering, which monitors 13 billion security events per day.

A host of other Big Blue offerings have been integrated into QRadar, including IBM Security Identity Manager and IBM Security Access Manager to mitigate the insider threat.

There are no vendors that can cover that breadth and that’s really the value we bring.

Future integration modules are also being released for non-IBM products, including Symantec DLP, Websense Triton, Stonesoft, Stonegate and others.

"Essentially we support Symantec and McAfee and can extend to others. We don't support HP Arcsight," IBM told IT Pro.

Martin Borrett, director of the Institute of Advanced Security at IBM, said there had been a “wealth of excitement” around what Big Blue could do with Q1 Labs technology.

“We’ve been trying to figure out how IBM can take it to the next level, integrating our research and existing product line,” Borrett told IT Pro.

“At this stage, apart from driving more scalability into the platform itself with new appliances, it’s really about those flows in and out. We had all the insight from the X-Force but it just wasn’t plugged into the platform in the way that it will be now. It’s really about that crucial integration.”

The release also marks another major moment for IBM in establishing itself as a major security services player.

However, it faces strong competition in the SIEM space, with Symantec already offering a well-respected product, HP running its Arcsight-based offerings and McAfee set to boost its presence in the market after acquiring Nitro Security.

Borrett said IBM had “significant differentiation” in the market, thanks to the large number of sources QRadar can access and the insight it can get from the data.

“There are no vendors that can cover that breadth and that’s really the value we bring,” he claimed.

“The depth of the analytics we can get out of the Q1 platform I think is significantly stronger and better than our competition. Because of the context we can do it in... and the real-time capability [QRadar] is significantly better than the competition.”

As for the SIEM market in general, with major players coming in and swamping the market, Borrett claimed there was still room for smaller players to partner with bigger vendors to supply more insight for bigger offerings.

“The important thing is that those capabilities integrate into these other platforms and into our platforms in particular,” he added.

Email to a friend

Print this page