ISECO
Toolset

Ticketing extends QRadar’s native incident investigation workflow through integration with third-party ticketing tools. It supports manual and automatic ticket creation and bidirectional synchronisation of status, notes and closure information between QRadar offenses and external tickets. Configurable rules select templates and prefill ticket details.

Features

• Creating ticket templates
• Manual ticket creation right from the IBM QRadar offense user interface by choosing a template and creating a ticket
• Option to define rules for template selection and/or pre-fill data for external ticket
• Usage of conditions in rules based on the rule name, IP address, user name, and more
• Modular architecture to support various external ticketing tools
• Bidirectional synchronisation of notes between an offense and an external ticket
• Automatic offense closure after ticket closure (and vice versa)

LogBook helps track user and administrator activity in IBM QRadar by linking native audit records to easy-to-read entries in an operational logbook.

Features

• Automatic search of native audit messages in IBM QRadar connected to user activity
• Creating a logbook entry and linking it to native IBM QRadar audit records
• Approval workflow for storing logbook entries
• Unalterable entries in the operation logbook

Reporting improves the availability of IBM QRadar reports for external users and adds other missing functions – e.g. distribution of non-empty reports, possibility to parameterise queries and add external information to reports.

Features

• Distribution of generated native IBM QRadar reports to remote storage
• Possibility of distributing non-empty reports only
• Sending summary email notifications about available reports
• Configuration of report distribution / sending of email notifications using native user roles / IBM QRadar security profiles
• Creating parameterised AQL reports
• Creating advanced AQL reports exported to MS Excel format

Backup application extends the IBM QRadar default backup module and adds the possibility of distributing backups to external storage, introduces unified supervision of the backup process and the ability to create custom backups beyond standard backups.

Features

• Distribution of IBM QRadar native backups to remote storage (SMB, NFS, SFTP)
• Creating a custom archive from any folder in IBM QRadar
• Maintaining archive retention on remote storage
• Advanced backup scheduling options
• Support of multiple sources and backup destinations
• Monitoring of all operations with IBM QRadar native tools (logs, rules)
• Support for distributed and high-availability (HA) deployments
• IBM QRadar SDK native application (QRadar in version 7.3.2 and higher)

Log Enhancer enriches the incoming messages with external information.

Features

• Add missing information to a message, such as a DNS name where only an IP address is provided, or map an employee number to a username
• Using enriched information in the standard way - in custom entries or correlation rules
• Availability of 2 enrichment modes - direct (only the enriched message is saved in IBM QRadar) and redirected (original and enriched messages are saved in the IBM QRadar)

Based on our experience getting data from different log sources into IBM QRadar, we can offer our own agents for integrating unsupported or hard-to-integrate log sources.

IBM iSeries (AS 400)

Agent for IBM iSeries (AJEMON – Audit Journal Entry Monitor) reads information from IBM iSeries internal audit journal, formats it, and sends it to IBM QRadar using syslog. The agent was specifically created for the IBM iSeries with a deep knowledge of IBM iSeries audit subsystem and is fully configurable including filtering options. Monitoring of events from the message queue is available as an extension.

MSSQL audit agent

The MSSQL audit collection agent includes a configurable set of components for securely reading MSSQL audit data without affecting the monitored system. It addresses known limitations of the MSSQL auditing system, such as file locking and service interruptions.

Custom agents

If you’re looking for a way to integrate a specific system or a non-standard log format, turn to us. Our team has years of experience with integrations for IBM QRadar and we’re ready to help.