ExtraHop, provider of enterprise cyber analytics from the inside out, today launched the ExtraHop for IBM QRadar app, which integrates with IBM Security Intelligence technology to stream accurate, contextual network behavioural detections into the QRadar SIEM. With Reveal(x) detections in QRadar, organisations have a complete picture of suspicious or anomalous behaviour on their network, as well as the ability to perform rapid, guided investigations. This bi-directional integration lets analysts move back to ExtraHop to explore forensic detail captured from network data.
The new application is freely available to the security community through IBM Security App Exchange, a platform where developers across the industry can share applications based on IBM Security technologies. As sophisticated threats evolve, collaborative development among security providers is critical to helping organisations adapt quickly and to speeding innovation in the fight against cybercrime.
The ExtraHop app complements IBM QRadar, the company’s Security Intelligence platform, which gives organisations complete visibility into their entire infrastructure in real-time and applies advanced analytics to prioritise critical threats. Leveraging QRadar’s open application programming interface (API), ExtraHop allows joint customers to stream Reveal(x) machine learning-powered detections of anomalous and malicious behaviours into QRadar, where they can sort the events by title, risk score, update time, and more. Security teams can also search for specific events, quickly drill down to investigate IP addresses of offenders and victims in Reveal(x), and create new rules based on Reveal(x) detections of anomalous and malicious behaviours. Each detection viewed within QRadar is linked to the Reveal(x) environment, enabling analysts to quickly pivot to Reveal(x) and extract immediate, contextual details they simply cannot gather from log and netflow data alone.
Rich insights (4700 metadata types) extracted in real time from network traffic are especially important to identify late-stage attack activity, including lateral movement, privilege escalation, command and control (C2), and exfiltration. Real-time detections of these and other behaviours enable SOC analysts using IBM QRadar to recognize attacks earlier, with higher confidence, and access forensic-quality detail to validate and deposition an incident with less effort and time.
“Hundreds of our joint enterprise-class customers have told us that IBM and ExtraHop working together helps them adopt a security-first approach. With our powerful technical integration, global enterprises will have access to invaluable automated threat detection, correlation, and investigation,” said Raja Mukerji, Chief Customer Officer and Co-Founder at ExtraHop. “Now ExtraHop and IBM QRadar app customers will have complete real-time visibility into suspicious network activity and the ability to quickly detect and investigate threats to critical assets.”
The ExtraHop for IBM QRadar app is available for free download on the IBM Security App Exchange and also from the ExtraHop Solution Bundles Gallery.
About ExtraHop
ExtraHop provides enterprise cyber analytics that deliver security and performance from the inside out. Our breakthrough approach analyzes all network interactions in real time and applies advanced machine learning to help you investigate threats, ensure the delivery of critical applications, and protect your investment in the cloud. With this approach, we help the world’s leading enterprises including Credit Suisse, Hasbro, Caesars Entertainment, and Liberty Global rise above the noise of alerts, organizational silos, and runaway technology with complete visibility, real-time detection, and guided investigation. To experience the power of ExtraHop, explore our interactive online demo or connect with us on LinkedIn and Twitter.
