IBM Security QRadar SOAR

There is a new integration between IBM Security Resilient and IBM Security Guardium Data Protection, IBM’s leading data security solution that helps organizations discover, classify, monitor, protect and report on their organization’s critical data both on-premise and in the cloud. As companies rapidly adopt cloud-based databases and data sources, a centralized console to manage and secure these data sources in addition to on-premise deployments is critical. Doing so in the context of investigating and responding to a security incident makes it even more important.

The integration between IBM Security Guardium Data Protection and Resilient allows analysts investigating and responding to an incident enrich Resilient workflows with database-level information and protect data sources from risky users.

These new functions allow you to:

• Enrich Resilient incidents and workflows with Guardium Data Protections’ robust reporting capabilities
  • For example, Guardium can provide user information on risky behavior or entitlements to sensitive data
• Block risky users from accessing databases that house sensitive data

You can download the integration on the App Exchange here.

Details on the integration:

1. Run Active Risk Spotter - Risky Users Scores.
2. Search for Entitlements to Sensitive Objects.
3. Search for User Outlier Details.
4. List Parameter Names By Report Name.
5. Search All Guardium Reports.
6. Block Userfrom Data Source.
7. Generate Guardium Client Secret from Resilient.

To integrate IBM Security Guardium with the IBM Security Resilient platform, visit the IBM Security App Exchange to download the app.