IBM Software and Solutions

Data profiling, data quality reporting 

Sometimes a project knows little about its data. IA is good at data profiling / data discovery. It can give insight into data about data type, format, uniqueness, completeness, frequency distribution, etc. The other powerful feature of IA is its ability to check data against business rules. It can give statistics on how many records violate a rule.

Data rules, column analysis, virtual tables

The interface is not the most friendly. Performance.

There are also these following features - documented in the user guide - but do not work:

1. Global Logical Variables (GLVs)

2. Migrating projects. Neither the internal method (Export/Import) nor the command line interface (CLI) method work 100%. They sometimes error out.

3. When you open a data rule and do no modifications, when you close it, IA asks if you want to save the changes, even if you did not make any. A bit disturbing when you know you did not change anything yet you start to doubt what you think you know.

My wish list for new features:

1. Ability to use functions on data sources. I do not understand how IBM could miss this. Data sources are not visible when coding custom expressions. For example if you have a field called CUSTOMER.ACCOUNT_NUM, you cannot code TRIM(ACCOUNT_NUM). My workaround is to create a variable in the rule definition then bind it in the data rule. Functions can only be applied to variables, not directly to fields. I have a rule where I do things to about 12 fields - concatenate, substring, length, coalesce, etc - and I had to make up 12 lines in the definition that do nothing but refer to these variables. I had to invent a rule so I coded seemingly useless rule conditions like address1 = address1 just so I have a variable for the field I want to code functions for. Huge oversight on the part of IBM.

2. Copy a data rule and modify the copy. Right now only rule definitions can be copied, not data rules. Sometimes I need to create two or more versions of the same rule. IA forces me to generate each of them from scratch. This is annoying when version 2 is only slightly different from version 1. If it took me an hour to code the original, it would take me close to that amount of time to code the new version. If I could copy and modify, the effort would only take maybe 5 minutes.

3. The date of last modification. IA only shows the date of creation which is generally useless. The last modification date is far more important and needs to be available and visible.

4. A file manager, a la Windows Explorer. I may want to see the list of rules and sort them by date of modification.

5. Enhanced dedup on output. Currently, IA can only exclude duplicates based on the entire record. It should allow deduping on a select set of columns.

6. Feature to select one record from multiple matches in a join. For instance, in Oracle SQL, one can FETCH FIRST ROW ONLY or use ROWNUM or TOP 1.

7. Ability to sort the output.

8. New virtual tables take a while to appear. You create one and the list doesn't list the new table. Wait 15 minutes or so and maybe it will be listed. Or log out and log back in. 

Since 2008. 

The tool sometimes crashes or freezes. But the latest version, 11.7, is more than stable than previous ones. 

Customer Service:

Scale of 1 to 10: 8. While IBM is excellent at responding to inquiries, it is slow to implement much-needed software fixes. While that is common in the industry, I would still like to see IBM fix software bugs sooner.

Technical Support:

Same as customer service.

Positive

No never had the chance.

I have not been involved in setup but I understand it is very complex, not for the faint of heart.

Excellent!

I was not involved in the selection. 

Get the latest version. Compare with competing products. Know that there are not many experts in the product and that they may pay a premium to hire them.

We are working mostly with the DC migrations as we are partnered with IBM on migration sites mostly. Apart from that, we're also working with the cloud and the networking implementation for any new architecture someone wants to implement.

Mostly when I compare it with Amazon, I just would appreciate AWS because there are a lot of complexities on the IBM side when we create a direct connection. In Amazon, we secure our connection with the ISP. For direct connection, it is covered by AWS. On IBM's side, we are securing all our connections. For example, we highlight the IPv6 or VPN connection for direct connection. So, Amazon avoids such situations. Hence, instead of IBM, I just appreciate the efforts by AWS when it comes to the cloud.

The solution's complexity and the need for the creation of direct connections are areas that IBM should focus on improving.

There are a couple of things that need to be improved. Like, their virtualization, like, they use virtualization on their backend. So there are a lot of things, like, they don't support the required OS, or they don't support it because of which sometimes we need to consider migration. There are also a lot of complexities in Red Hat, Ubuntu, and CentOS that need to be improved. We also had raised the case with the support team on-site, but literally, what I am just finding here is that there are a lot of improvements needed in the architecture side of IBM.

I don't think any new features are required since most of the cloud service providers are just using different terminologies to provide the same features or services. However, there is a need for more security in IBM compared to Azure and Amazon, which are the most secure ones since they put more on their security side.

I have been using IBM Public Cloud for a year and a half. My company has a partnership with IBM.

The solution is mostly stable because they have some high-potential clients. IBM provides support to companies like Toyota and some others. It is a stable solution.

The beauty of cloud service providers, especially public cloud service providers, is that they are scalable every time when you need them because their payment model is pay-as-you-go. So most of the public cloud service providers are following this model.

Recently, we also scaled FortiGate from two CPUs to four.

They do provide us with support because we have a long working relationship with them. So they give more preference while providing support, especially during our migration window or other, like, architectural designing work.

The initial setup process is easy.

Mostly, we are just on the migration side when we open a vendor with the client. On the migration side, we just first process that, and we just give them RTO and RPO if there is a loss in case though we give all the precautions along with the first call. Then, if they agree to migrate their data and resize, we take access to IBM support alongside the account at an administrator-level privilege. After that, we start the migration window, and we ask them for the downtime while also mentioning that the downtime would be needed in the meanwhile. So, this is the process.

We need people for deployment, especially since our company is in the WAN cloud. So, we created a VPC+ product, which is mostly multi-cloud migration in a DDoS product. VPC+ is our own product on which we mostly do the migration.

The solution requires maintenance. We can't say it is difficult to maintain it. But there are a lot of complications in the process. So every time we do the process, we face the complications. So then we resolve it as a team.

IBM has a lesser price compared to other cloud service providers like Azure and AWS. So that's why people are referring mostly to IBM rather than the other cloud services. Most South American countries, like Brazil and Mexico, are likely to deploy their infrastructure in IBM rather than AWS and Azure.

Recently, we just faced some issues with the operating system due to the end of life of CentOS 6. So, in my opinion, IBM doesn't have any support for CentOS 6. And likewise, we have a client that has CentOS 6 or a lower OS, and they needed to migrate it to the new data center. So they need some assistance with the migration and their infrastructure. So, then the client wanted to try it out under AWS instead of IBM. In short, it has some complexities.

Since it's not ready to date, I can't even say that it is very good as there are a lot of things that need to be improved, because of which I rate the overall solution a seven out of ten.

We use IBM Integration Bus within a finance domain.

The product helps efficiently work with different connectors from different back-end systems.

IBM Integration Bus needs to be more compatible with stable connectors for specific domains. For instance, it has two protocols: ISO 8583, a legacy protocol, and ISO 2022, which works on XML for the finance sector. Similarly, they should add connectors to banking applications and other specific industries.

We have been using IBM Integration Bus for ten years.

Being in the market for quite some years, IBM is a very stable and mature product. I rate its stability a seven out of ten.

The technical support services are good.

Primarily, our customers have the product deployed on-premises to follow protocols. Some customers deploy on private clouds as well. The product’s installation and configuration process is straightforward. It takes six months to two years, depending on the complexity of specific requirements.

I rate IBM Integration Bus a seven out of ten.

I have worked on several use cases, including creating custom ones. QRadar also provides built-in use cases.

Once integrated, you gain comprehensive visibility into all threats. The user behavior analytics module is particularly strong, and adding features allowing integration with third-party threat intelligence services enhances the analysts' ability to identify threats.

The best aspect of Pareto is its user-friendliness. Unlike other solutions requiring query language knowledge, Pareto is entirely GUI-based. This makes it easy to use and understand without learning any query languages.

People are increasingly moving towards big data tools, so QRadar needs to enhance its compatibility. For example, QRadar does not integrate with SAP HANA, widely used in large industries. Similarly, QRadar lacks support for integrating with Fortinet's firewall management services, resulting in limited visibility.

It is still in its early stages. AI analytics require further development because, in my experience, they often generate false positive alerts.

I have been using IBM Security QRadar for seven years.

It is very much stable.

On-premises deployments can be challenging to scale. In contrast, cloud solutions offer much greater scalability; you simply place an order for the required EPS, get approval, and then proceed. This process is more straightforward and faster than on-premises setups.

The initial setup is user-friendly and straightforward, making deployment easy. However, compatibility issues with other security controls still need to be addressed. It provides a 35-day period for project enablement. This timeframe is too short and should be extended to 45 or 50 days.

When deploying QRadar on-premises, we assess the organization's size to determine the required number of UPS units, application servers, and other necessary hardware. Once these requirements are identified, we proceed with the deployment.

We face challenges in the deployment phase, especially when working with an MSSP license. The main issue is with QRadar's multi-tenancy, which often causes the system to crash. Their support services are not very helpful in addressing these problems.

We allocate two working days for the deployment of QRadar for our customers. Our team includes a senior engineer who communicates with the client and a junior engineer responsible for deploying and installing other services.

The deployment time can vary based on the size of the setup. Large deployments, such as those with 20,000 to 25,000 EPS for corporate clients, take longer due to the need for multiple hardware servers. In such cases, it can take several days. QRadar can be installed in about three to four hours for smaller setups.

The price is lower than Splunk but remains high compared to other SIEMs like LogRhythm, Elastic, and RSA. For example, 1,000 EPS costs around $55,000. While it's somewhat more affordable than Splunk, it is still higher than LogRhythm, Elastic, and RSA.

QRadar offers a clean solution with straightforward integration for various devices. Once you define your scope, you effectively gain visibility into it. When comparing QRadar to other SIEM solutions like GloD and Splunk, QRadar lags behind other modern advancements. While new SIEM solutions focus on data lakes and big data, QRadar continues to rely on traditional correlation modules.

QRadar should prioritize R&D and product improvement. Their support services have also declined and need attention.

In QRadar's user behavior analytics, we observed an alert triggered by an unusual login attempt from one of our administrators. While monitoring alerts during my shift, QRadar's anomaly-based detection identified a login attempt outside normal hours. The system detected this as a deviation from the established baseline since the administrator had never logged in at that time before. This triggered the alert, helping us identify the compromised account.

QRadar requires ongoing maintenance, and running it effectively often depends on support from engineers. Unlike big data tools, QRadar can struggle with integration and may require fine-tuning, restarts, or troubleshooting if issues arise. Since its merger with other companies, we've encountered many problems and have experienced delays in receiving timely technical support.

You don’t need to learn any additional tools to use the system. It allows you to create dashboards from a management perspective, and its user behavior analytics work very well, although the AI analytics module is still developing.

When handling compliance requests or forensic investigations, an SIEM solution like QRadar is essential. It helps pull up logs and identify what happened during incidents or breaches.

The time required for investigation depends entirely on the impact of the attack. Sometimes, only a single device or network is compromised, which may be resolved quickly. However, the investigation takes longer in cases where the scope is broader, involving multiple devices and networks. The timeframe is driven by the extent of the incident, not just by QRadar.

QRadar is a good product. In Pakistan, many financial sectors are starting to shift towards other solutions. In South Asia, particularly Pakistan, has a growing trend towards Splunk. Similarly, there is a shift towards Splunk, LogRhythm, and RSA in the Gulf region. 

Overall, I rate the solution a seven out of ten.