QRadar SIEM Consulting for a South Asian Bank and Governmental Organization

Summary

In partnership with a South Asian system integrator, INNERLUXES worked with two end customers in the same region — a major bank and a governmental organization — to deepen their teams' IBM Security QRadar SIEM expertise. INNERLUXES's SIEM consultants designed and ran tailored training (Fundamentals and Advanced modules for the bank, the Advanced module for the governmental organization), combining interactive lecturing with hands-on mentoring.

About the Client

In partnership with a South Asian system integrator, INNERLUXES embarked on cooperation with two end customers in the same region: a major bank and a governmental organization.

The Challenge

To patch security gaps and master the variety of administrative tools for QRadar deployment, both customers wanted to give their QRadar administrators and analysts in-depth QRadar knowledge and skills. With that objective in view, based on the customers' detailed requirements and the trainees' SIEM experience, INNERLUXES's SIEM consultants organized and conducted tailored training sessions — Fundamentals and Advanced Training modules for the bank, and the Advanced Training module for the governmental organization.

The Solution

As a starting point, INNERLUXES's SIEM experts drew up customer-specific agendas for the training sessions.

The one-day Fundamentals Training module included:

• Introduction to IBM Security QRadar SIEM
• Security Data
• QRadar User Interface
• Data Sources
• Advanced Searching
• Rules and Building Blocks
• Advanced Reporting
• Health Monitoring

The four-day Advanced Training module, aimed at more QRadar-savvy specialists, extended the scope with:

• Introduction to QRadar administration features and functionality
• Security events normalization
• Building LSX (normalization part)
• Building LSX (mapping part)
• Building Blocks (BB) overview and specifics; enabling custom BB
• Rules overview
• Creating rules
• Tuning rules
• Fine-tuning false positives
• Offenses
• QRadar Risk Manager
• QRadar Vulnerability Manager

With the agendas revised and approved and the venues and infrastructure in place, INNERLUXES's SIEM professionals followed a thought-through training approach combining interactive lecturing and mentoring, enabling the trainees to gain hands-on QRadar experience. At the end of each session, participants received a QRadar SIEM training completion certificate.

The Results

• Having completed the QRadar training course, the customers' security specialists were able to take their organizations' security to a much higher level, ensuring better protection.
• The knowledge and skills gained during the training proved sufficient for obtaining the IBM QRadar Associate certification.

Technologies and Tools

IBM Security QRadar SIEM.