IBM Resilient Security Orchestration, Automation and Response (SOAR) Platform Reviews

It is quite simple to construct a workflow by dragging dropdown boxes and connecting them; the interface provides a fantastic method to view the stages we are developing and allows us to rapidly apply each of them. The biggest advantage is its extensive connectivity library, which allows us to connect to Jira, Lacework, Gsuite, and other providers as needed. The combination of all of these SaaS offerings results in unique commercial capabilities.

It rapidly hits its limits when it comes to sophisticated transformations and manipulations, and implementations become quite difficult. I'd like to be able to effortlessly version control all of my tales, hide my secrets, and even edit them with pull requests. I would want to see first-rate integration with a version control system.

The key issue that he assists the organization with is reducing the amount of time spent on repeated manual operations by utilizing some security measures. We were able to automate several procedures by interacting with numerous tools and incorporating various people from various teams and roles, which increased efficiency and saved time. We mostly use IBM Security QRadar SOAR to test for vulnerabilities; it allows you to analyze the complete event payload and filter and add a lot of relevant information to the Jira ticket. We can use IBM Security QRadar SOAR to swiftly automate processes that are resilient, auditable, and debuggable without having to write any code.

units with advanced capabilities to manage and automate security operations.

Some of the features on the appreciation surface are the ability to maintain and analyze security protections, automate incident response business processes and integrate them with various security tools.

It manages to increase the protections of security operations and help respond effectively to threats.

While IBM Security QRadar SOAR has many powerful features, it is worth noting that some users may find the platform initially complex to install and configure. Also, depending on an organization's specific needs and requirements, there can be a learning curve involved in understanding and effectively using all the functionality of the platform. It is always a good idea to evaluate different solutions and consider factors such as usability, integration capabilities and overall fit with your organization's security operations

It meets almost all expectations on the SOC side.

We recently built a Resilient solution in the IBM cloud. The Resilient tool is being used to demonstrate capabilities and train our internal personnel for the internal production SOAR deployment too. The set up was easy and within just a couple days we were already realizing the value of Resilient.

I wish there was more guidance for the use of the Resilient SOAR tool. The documentation is lacking is some areas and is rudimentary. We need more guidance around how to set up playbooks, use of functions and workflows, how integrations can be further developed. There is a heavy reliance on GitHub and community development that can be difficult to find, validate and implement if inexperienced with the tool.

We immediately realized time savings benefits for SOC analysts. The threat intelligence was easy to set up and showed value very quickly.

Process Oriented ! Product allow to build and use dynamic workflow with very useful. Resilient is very powerful from the user interface to the integration of functions in a BMMN like view. Products integrate a privacy module (have to pay) wich is very helpful too for internationals company and for the DPO.

From the action / circuits part (function implementations) you have to download what you need and implement it on your own, you don't to select it directly from the product. Maybe some improvement to do on reporting scheduling.

Very usefull for incident response, and most of all, to get orchestration and fast answer for the analyst with SI integrations. In the point of Management (dashboard/report) and for the analyst, user. For DevSecOps the API is well documented.

It makes integration very easy with real time dashboard.

There nothing that I dislike about this system.

It has made decision making very effective as it guides the time through best responses.

Easy to navigate, no experience needed!

Nothing that I can think of it’s a very well rounded project.

I benefit in learning a new softaware that enables me to work at a quicker and steadier pace.

Easy to navigate when I am in a pinch.

Slow response time when I have customers waiting on a response.

N/a

The opportunity to solve serious issues without leaving it in the hands of people that aren’t able to actually help.

IBM Security QRadar SOAR is Security Orchestration, Automation and Response. It is used to generate automatic response against any malicious activity performed overall the infrastructure of any organization. we can create playbooks to automate the process . Like if any user is trying to access a website that is being blocked over the firewall, hence we can block the IP of the user on firewall so he may not access the blocked website.

Creating playbooks requires a programming development skill such as one must learn python language so he can easily create playbooks. We can disable active directory user through SOAR against any malicious activity.

IBM Security QRadar SOAR is used to generate automatic response. So it can be used as incident register and also for incident response through customized build playbooks.

Strong rules writing and reference sets are very useful

Graphical interfaces. Such as filter columns are not dynamic and sorting is not work

Authorization Problem, Network attacks

Good to use. User friendly, support from IBM

Right now it is getting replaced by CP4S. Hence very less integrations out of box.

Old product. Will be getting replaced by IBM CP4S.

SOAR tool, used for consolidating security incidents for better visibilty.