{"id":53995,"date":"2023-10-06T14:52:00","date_gmt":"2023-10-06T14:52:00","guid":{"rendered":"https:\/\/www.networkworld.com\/article\/3708271\/ibm-leans-into-ai-for-managed-security-services.html#tk.rss_security"},"modified":"2023-10-06T14:52:00","modified_gmt":"2023-10-06T14:52:00","slug":"ibm-leans-into-ai-for-managed-security-services","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ibm-leans-into-ai-for-managed-security-services\/","title":{"rendered":"IBM leans into AI for managed security services"},"content":{"rendered":"
<\/div>\n

IBM is rolling out AI-based managed services that promise to help network and security operations teams more quickly and effectively respond to enterprise cyber threats.<\/p>\n

Managed by the IBM Consulting group, the Threat Detection and Response (TDR) Services offering promises 24×7 monitoring, investigation, and automated remediation of security alerts from existing security tools as well as cloud, on-premises, and operational technology systems utilizing the enterprise network. The services can integrate information from more than 15 security event and incident management (SIEM) tools and multiple third-party endpoint and network detection and response packages, for example.<\/p>\n

The idea is to help enterprise customers get a handle on the myriad vulnerabilities, alerts and security tools they have to deal with on a daily basis. By using AI and other analytics capabilities, the new managed services can automate away the noise and let IT teams focus on escalating critical threats to the business, IBM stated.<\/p>\n

IBM’s new TDR Services, available now, typically work without requiring agents to gather information from customers\u2019 enterprise environment, such as servers, endpoints and other devices. Combined with information from IBM X-Force’s global network of sensors and intelligence analysis, the services use AI models and tools to filter out client-defined, non-critical problems and false positives to automatically generate high-risk alerts that require immediate action by security teams while offering investigation context, according to IBM.<\/p>\n

\u201cIBM [managed detection and response (MDR)] is able to detect threats across the entire IT estate, do network-based detections including full packet capture and inspection, as well as detect a wide range of malicious activity, including ransomware and evasive malware. The service also includes attacker behavior analytics,\u201d according to a recent MDR report<\/a> from KuppingerCole.<\/p>\n

\u201cIBM MDR is able to execute predefined containment actions automatically, including terminating processes and network sessions, isolating hosts, blocking communications by port and IP, quarantining files, carrying out sinkholing, and preventing registry changes,\u201d KuppingerCole stated.<\/p>\n