QRadar SOAR: Integrating with SIEM [TDS_BQ430G]

OVERVIEW

In this couse, you learn about the IBM Security® QRadar® SIEM and QRadar SOAR apps that automate data exchange and improve the security incident investigation. You gain knowledge on how to integrate QRadar SOAR and SIEM. You improve incident response by using the SOAR Plug-in App on SIEM and analyzing SIEM's offense in SOAR's QRadar Offense Details tab. You build a playbook and run a query by configuring the QRadar Integration app in a set of useful functions.

Virtual Learning

This interactive training can be taken from any location, your office or home and is delivered by a trainer. This training does not have any delegates in the class with the instructor, since all delegates are virtually connected. Virtual delegates do not travel to this course, Global Knowledge will send you all the information needed before the start of the course and you can test the logins.

OBJECTIVES

In this course, you learn the following skills:

• Improve response by analyzing QRadar SIEM Offense details
• Configure QRadar Integration Apps from X-Force Exchange
• Build a table and run a query
• Develop a playbook

AUDIENCE

Security Operations Center (SOC) AdministratorSOC AnalystSecurity AnalystIncident ResponderManaged Service Security Provider (MSSP)

CONTENT

QRadar SOAR Integrating with SIEM

• Installation of SIEM and SOAR apps from the X-Force Exchange
• Configuring access to SOAR server on QRadar SIEM
• Analyzing the QRadar Offense Details tab
• Building a playbook and analyzing results