Archived content

Archive date: 2025-12-17

This content is no longer being updated or maintained. The content is provided “as is.” Given the rapid evolution of technology, some content, steps, or illustrations may have changed.

In today's rapidly evolving digital landscape, safeguarding your organization against cyber threats is more crucial than ever before. With the increasing frequency and complexity of insider threats, it is important to strengthen your security posture and protect sensitive data. IBM Security stands at the forefront of the cybersecurity industry, offering a comprehensive suite of advanced solutions to assist organizations in defending against evolving threats. This article explores how to seamlessly integrate IBM QRadar with IBM Security Verify Privilege and Verify SaaS can enhance your security defenses and effectively mitigate insider threats.

Understanding the insider threat landscape

Insider threats present a substantial risk to organizations regardless of their size. These threats may originate from employees, contractors, or business partners who have access to your organization's systems, data, and networks. Motivations behind insider threats can range from financial gain, espionage, and sabotage to unintentional negligence. Effectively addressing these threats requires organizations to adopt a comprehensive security strategy including proactive threat detection, privileged access management, and robust data protection measures.

IBM Security solutions

IBM Security offers a range of robust solutions tailored to tackle various facets of cybersecurity. Let's take a closer look at the key components of IBM's security portfolio and how they contribute to safeguarding your organization:

IBM Security QRadar is a market-leading Security Information and Event Management (SIEM) solution, orchestrating prioritized, real-time alerts through the correlation of analytics, threat intelligence, and anomalies in network and user behavior. This enables security analysts to concentrate on investigating and mitigating pertinent threats. QRadar SIEM streamlines threat remediation, enabling the identification of threats that may elude other solutions. With QRadar, you and your security team can:

Detect targeted threats promptly with real-time, prioritized alerts.
Seamlessly integrate Network Detection and Response (NDR) for comprehensive monitoring of network flows tied to event or log data.
Leverage over 700 integrations to proactively detect and respond to threats through a wide range of tightly integrated add-on offerings.
Implement 1,500 out-of-the-box use cases aligned with MITRE ATT&CK, facilitating quick identification and correlation of activities across the kill chain with end-to-end visibility.
Use an intuitive, automated query builder equipped with smart property detection to quickly search and pinpoint valuable data without the need for writing rules or code.

IBM Security Verify SaaS is a fully cloud-based Identity and Access Management (IAM) solution, providing versatile hybrid cloud deployment options ranging from public cloud to private, native, and on-premises environments. Verify SaaS offers:

Core identity base capabilities catering to both your workforce and consumers, including adaptive access and advanced authentication functionalities, powered by Trusteer’s AI-enabled engine.
Single sign-on functionality facilitating centralized access control across both cloud-based and on-premises resources.
Adaptive access features enabling risk-based authentication measures.
Advanced authentication mechanisms ensuring seamless and frictionless access.
Built-in privacy and consent management capabilities seamlessly integrated into easily adoptable workflows.
Full lifecycle management capabilities facilitating the alignment of application access with business governance workflows.

IBM Security Verify Privilege is IBM's Privileged Access Management (PAM) solution designed to address privileged account use cases. The privilege portfolio encompasses Privilege Vault, Privilege Manager, Server Suite, and DevOps Vault. Security Verify Privilege Vault offers comprehensive privileged access management (PAM) capabilities aimed at safeguarding your organization's most critical assets from cyberattacks and insider threats.

Available in both on-premises and cloud deployments, IBM Security Verify Privilege Vault facilitates the discovery, management, protection, and auditing of privileged accounts across your organization.
Privileged users can access credentials locally or within the organization's internal network.
PAM solutions ensure privileged accounts' accessibility from any location.
IBM Security Verify Privilege Vault provides centralized, policy-based controls to enable remote workers to securely access privileged accounts, whether in the cloud or on-premises.
The solution provides stringent security practices while enabling remote access to privileged accounts.

Integrating IBM QRadar with Verify SaaS and Verify Privilege

The figure shows the high-level architecture of the developed integration of IBM QRadar with Verify Saas and Verify Privilege for detecting and blocking insider threats as shown in the following demonstration video. The architecture depicts a robust security infrastructure ensuring controlled access to both SaaS and legacy applications within the organization.

IBM Security at work

Figure: Architecture of integrating IBM QRadar with Verify Saas and Verify Privilege

Users attempting to access SaaS and legacy applications must first undergo authentication through IBM Security Verify SaaS. IBM Security Verify Privilege manages time-bound privileged user access. IBM QRadar collects logs from Verify SaaS, Verify Privilege, and apps, enabling comprehensive monitoring. QRadar uses Verify REST APIs to take corrective actions against suspicious user activities, enhancing proactive threat response.

The integration of IBM QRadar with Verify SaaS and Verify Privilege provides several significant benefits:

Enhanced threat detection: Strengthen your organization’s capability to quickly detect and respond to insider threats by correlating privileged access events, user activities, and security incidents.
Privileged user session recording and monitoring: Get visibility into privileged user activities, enabling the identification of potential security risks such as unauthorized access or privilege abuse.
Streamlined centralized identity management: Simplify user identity and access management across your organization’s IT landscape, ensuring consistent policy enforcement.
Vault Analytics: Facilitate seamless investigation through an analytics dashboard, allowing the identification of erratic user behavior, commonly used secrets, and the provision of alerts.

Blocking or disabling a malicious user

After detecting a insider threat, to proactively block a malicious user access, use the following example bash script.

Replace tenant_url, client_id, client_secret, and username with the corresponding values from your environment. Rules set in IBM QRadar will activate if a user logs in from multiple locations rapidly and engages in unauthorized activities. You can use the logs from Verify SaaS and Verify Privilege to extract the username, time, and type of activity. If all criteria are met, the rule triggers, and the user is disabled in Verify (via REST APIs) to prevent further harm.

```bash
#!/bin/bash
# Set your variables
tenant_url="<cloud identity url>"
client_id="<id>"
client_secret="<sec>"
username=$1
echo $username

# Make the curl request

curl_response=$(curl -k --request POST \
    --url "https://${tenant_url}/oauth2/token" \
    --header 'accept: application/json' \
    --header 'content-type: application/x-www-form-urlencoded' \
    --data "grant_type=client_credentials" \
    --data "scope=openid" \
    --data "client_id=${client_id}" \
    --data "client_secret=${client_secret}" \
    -k)

# Extract and print the access token

access_token=$(echo "$curl_response" | jq -r '.access_token')
echo "Access Token: $access_token"

# Set the JSON data in a variable

data='{
  "schemas": [
    "urn:ietf:params:scim:api:messages:2.0:PatchOp"
  ],
  "Operations": [
    {
      "op": "replace",
      "path": "active",
      "value": false
    }
  ]
}'
# Extracting the userid

response=$(curl -k --request GET \
 --url "https://${tenant_url}/v2.0/Users?filter=userName%20eq%20%22$username%22&attributes=id" \
 --header 'accept: application/scim+json' \
 --header "Authorization: Bearer $access_token")

# Extract the user ID using jq
userid=$(echo $response | jq -r '.Resources[0].id')
echo $userid

update_userstatus=$(curl -k --request PATCH \
    --url "https://${tenant_url}/v2.0/Users/${userid}/" \
    --header 'usershouldnotneedtoresetpassword: true' \
    --header 'content-type: application/scim+json' \
    --header 'accept: application/scim+json' \
    --header "Authorization: Bearer $access_token" \
    --data "$data" \
    -k)
```

Note: You can also choose to write your own script in Bash, Perl, or Python.

Detecting and blocking insider threats demo

The following video demonstrates how to detect insider threats and proactively block user access by integrating multiple IBM Security solutions with IBM QRadar.

Video will open in new tab or window.

The demonstration highlights the following techniques of strengthening access control and security measures against insider threats:

Implements custom action scripts within IBM QRadar to quickly block user access or isolate compromised systems in real-time during security incidents. These scripts provide an automated response mechanism, enabling organizations to mitigate security threats promptly and effectively.
Authenticates users through a centralized Identity and Access Management (IAM) system to enforce consistent access controls. This authentication mechanism validates user credentials uniformly across all systems, heightening security and minimizing the risk of unauthorized access.
Establishes a rigorous approval process to restrict access to the Linux machine exclusively to authorized users. This procedure ensures meticulous review and approval of access requests, thereby enhancing data security and thwarting unauthorized access attempts.
Integrates logs from IBM Verify Privilege and Verify SaaS into IBM QRadar for centralized monitoring of security events. This integration provides a unified view of security incidents, facilitating timely detection and response to threats. Additionally, direct integration of the Linux system with QRadar helps in identifying activities beyond Verify's purview.
Correlates events from diverse systems within IBM QRadar to pinpoint suspicious user activities. This mapping enhances the system's capability to detect patterns and anomalies indicative of potential malicious behavior.
Crafts tailored detection rules within IBM QRadar SIEM to actively monitor and identify suspicious or malicious activities. This allows organizations to proactively address security threats and enhance their overall security posture.

Summary and next steps

As insider threats persist as a significant risk to organizations, it becomes imperative to invest in a comprehensive security strategy incorporating advanced solutions such as IBM QRadar, Verify Privilege, and Verify SaaS. Through seamless integration of these components, organizations can elevate their security posture, improve detection of insider threats, and protect their invaluable assets. With IBM Security's state-of-the-art solutions, proactive measures can be taken to fortify your organization against evolving cybersecurity threats.

Explore our IBM Security product capabilities further by reviewing the following documents:

Secure your organization against insider threats with IBM Security products

Secure your organization against insider threats with IBM Security products