QRadar on Cloud offering is the IBM QRadar Security Intelligence SIEM running in the cloud, which can be deployed on IBM Cloud, Amazon AWS, Microsoft Azure and other public or private cloud services, and is also available as a fully Managed SIEM as a Service. This QRadar on Cloud SIEM service delivers a ready to use, Managed SIEM deployment that is maintenance free and includes all the features of the on premise QRadar Security Intelligence platform. QRadar on Cloud collects event logs and network flow security data of local, remote and Cloud IT application using a protected data gateway connection, so security personnel can analyze the stored events using QRadar’s advanced Machine Learning, Security AI and Behavior Analytics capabilities to identify vulnerabilities, cybersecurity and internal threats. Deploying QRadar in the Cloud considerably reduces upfront costs by allowing flexible monthly billing using a pay as you go pricing and grow model, versus purchasing hardware, software and implementing the SIEM from scratch. QRadar on Cloud pricing is based on events per second and network flows per minute the customer chooses to send to the SIEM in the Cloud.

Same Features Without The Upfront Cost

QRadar on Cloud SIEM enables customers to enjoy the same features of on-premises QRadar deployments without the upfront cost and having to setup and manage the infrastructure. QRadar on Cloud SIEM offering is also available as a fully managed MSIEM SIEM as a Service (SIEMaaS) by expert security engineers and analysts. By deploying QRadar on Cloud SIEM SaaS, software and OS updates are automatic, scaling for growth is on a “as needed” basis and on demand and all responsibilities of managing SIEM operations are done for the customer, whereas QRadar on Cloud still relies on a company’s security personnel to perform threat monitoring, vulnerability management, risk analysis and data breach remediation tasks. QRadar on Cloud does provide 24x7 infrastructure maintenance and support services, including software and OS upgrades, as well as applying all patches for customers.

Cloud SIEM Flexible Features

QRadar on Cloud SIEM is very flexible, allowing customers to start with basic log management and compliance reporting, and add more features and services as needed. In comparison to other Cloud SIEMs that do not offer additional and required features for vulnerability management and user behavior analytics to identify cybersecurity attackers, QRadar on Cloud provides these features if and when the customer sees the need. Other features and capabilities other Cloud based SIEMs do not always offer or can provide customers include: network flow data, user behavior analytics, granular administrator role permissions, API access, integration of cybersecurity threat feeds, IP reputation statistics, cloud service choice, automated asset/device discovery and low cost entry point for small companies.

Cloud SIEMs are perfect for organizations on a tight budget or struggling to find qualified resources to address their immediate security and compliance reporting needs. The Cloud SIEM SaaS licensing model converts large, upfront capital expenses needed for hardware and professional services engagements, to a simplified monthly OPEX cost, that can be upgraded as requirements change.

QRadar on Cloud Benefit Summary:

• Web browser accessibility

• Data collection, correlation and reporting capabilities to achieve regulatory compliance

• Ingests up to 80,000 Events Per Second (EPS) and 300,000 network flows per minutes (ideal for companies even with hundreds of global locations)

• Highly available system configuration for near continuous availability

• Apps, add-ons and extensions through IBM Security App Exchange

• X-Force Threat Intelligence feed on developing situations

• Many security threat feeds and vendor product integrations

• Ingest vast amounts of data from on premise, remote branches, international sites, and cloud sources

• Applies built-in analytics to accurately detect threats

• Correlate related activities to prioritize incidents

• Automatically parses and normalizes logs

• Threat intelligence and support for STIX/TAXII

• Integrates out-of-the-box with over 450 solutions

• Can be deployed with on premise SIEM, in Cloud and Hybrid

• Highly scalable, self-tuning and self-managing database

• Ingests Events and Network Flows

• User Behavior Analytics UBA

• Asset and Device Auto-Discovery

• Predefined SOC and management consoles (customizable)

• AI driven alerts

• Predefined rules for alerts, reports and compliance

• Real-time analytics

• API Access

• Granular Administration Roles

• 24x7 Support

• Dedicated DevOps

• Multitenant capabilities

• All Opex model; ability to grow elastically (as needed)

• No upgrades, updates, maintenance or hardware refresh cycles

Help Beyond Your Security Staff

Companies needing help beyond the capabilities their security staff has the time or expertise to provide, optional additional management services also are available. IBM’s security services SOC team help enterprises prevent, detect and respond to security threats and vulnerabilities with integrated hardware, software and service offerings. A flexible and scalable SIEM, powered by best of breed machine learning, security AI, analytics and IBM expertise. QRadar on Cloud uses the same underlying technology to deliver log management, network flow analysis, real-time and historical analytics and vulnerability management to any size of organization looking to outsource the acquisition, deployment and management of the QRadar security intelligence infrastructure.

IBM Cloud Data Centers Available Around The World

The solution is hosted within IBM Cloud Data Centers which is available worldwide. For regions with specific in-country data storage requirements, QRadar on Cloud is provided in the following Data Center locations: Dallas, TX; Toronto, Ontario Canada; Frankfurt, Germany; London UK; Sao Paulo, Brazil. Additional locations are planned. In addition, QRadar On Cloud has an open framework that enables easy integration with solutions posted on the IBM Security App Exchange. The IBM Security App Exchange allows customers to use applications from industry leading manufacture products, providing security application extensions and enhancements to both your QRadar SIEM and existing IT products. Security teams using QRadar on Cloud can download and install partner and vendor solutions at no extra charge.