Frequently asked questions

IBM Security QRadar SOAR is the leading platform for orchestrating and automating incident response processes with unique automation, reporting, and privacy capabilities, and numerous integrations with other security and IT tools. Today, numerous SOCs and Fusion centers rely on IBM Security QRadar SOAR to form their incident response hub, the center of their SOC.

A playbook is a set of tasks or workflow(s), which may or may not be automated, associated with a specific threat type. It determines the organizational response to a type of threat and guides analysts through the investigation and remediation process, therefore improving consistency and reducing time to respond. IBM Security QRadar SOAR playbooks are unique as they are dynamic and additive, which means that they evolve with an incident as new information is uncovered. Read the white paper on playbook-driven cybersecurity.

A workflow codifies and describes a specific set of tasks or actions around a particular security process. A playbook is made up of one or multiple workflows. To get up-to-speed on SOAR, read our white paper "How to Be a SOAR Winner".

Orchestration refers to the ability of a SOAR platform to integrate with other security tools through defined connectors. Once these disparate security tools are integrated, a SOAR platform such as IBM Security QRadar SOAR can execute a wider orchestration of people, technologies, and processes to respond to security incidents efficiently and effectively. To find other definitions of SOAR terminology read our white paper "How to Be a SOAR Winner".

Companies that can fully optimize a SOAR platform such as IBM Security QRadar SOAR need to understand and evaluate internal processes to assess if automation will provide the intended benefits and have the internal skills to customize and leverage the platform on an ongoing basis.

There are more than 160 IBM Validated and supported applications, and Community applications that can be integrated with IBM Security QRadar SOAR. You can download these applications from the IBM App Exchange, where new applications are being added regularly.

IBM Security QRadar SOAR with Privacy allows security teams to integrate privacy reporting tasks and deadlines into their overall incident response playbooks, and work together with your privacy and legal teams to address regulatory requirements. It also helps organizations maintain a single, auditable record of all aspects of their breach response.

At the heart of IBM Security QRadar SOAR with Privacy is the Global Knowledgebase, which is a regularly updated database that supports over 170 breach notification regulations globally, including GDPR, PIPEDA, HIPAA, and CCPA, among others. Read the data sheet for more information.

It is a capability of IBM Security QRadar SOAR designed to meet the specific requirements of managed SIEM and MDR service providers. It delivers the scalability and predictability that Service Providers need to grow their security business. Read the solution brief for more information.

Yes, by integrating IBM Security QRadar SOAR with a SIEM, such as IBM Security QRadar SIEM, you can build out a complete threat management solution that covers detection, investigation, and remediation of threats across a wide range of cybersecurity use cases. Read the solution brief for more information.

Yes, the Security Verify Functions for SOAR application allows you to act on user status from SOAR workflows and it updates the incident with results. Download the app from the App Exchange.

Yes, the MaaS360 functions for SOAR application enable  you to perform certain mobile device management (MDM) actions using MaaS360. Download the app from the App Exchange.

Yes, IBM Security QRadar SOAR can be deployed through IBM Cloud Pak for Security. As part of IBM Cloud Pak for Security, SOAR seamlessly integrates with Data Explorer and Threat Intelligence Insights.