Advanced IBM Qradar Incident Forensics enterprise information system cyber incident investigation technology

Abstract

The paper analyzes the problem of cybersecurity of the corporate information system and identifies the place, purpose and objectives of the investigation of cyber incidents of the corporate information system. The analysis of existing technologies of investigation of cyber incidents of the corporate information system is carried out. Methods and means of investigating cyber incidents of the corporate information system based on the IBM QRadar Incident Forensics solution are studied. The purpose, main functions and composition of the IBM QRadar Incident Forensics complex are determined. Based on the research conducted in the work, a variant of the technology of investigation of cyber incidents of the corporate information system and recommendations for the application of this technology in the enterprise have been developed. The technology of integration of IBM QRadar SIEM and IBM QRadar Incident Forensics is studied, the application of which increases the efficiency of the specialists of the Center for Cyber Security Management of the corporate information system.