What Kandaro does with it
Kandaro SOC and IBM QRadar.
Where your alerts already land. Kandaro reads them, opens cases and investigates.
- Alerts in
Reads its alerts and groups them into cases with fixed rules.
- Research
Searches it for related activity while it investigates a case. This uses Kandaro Connect.
How it connects
Pick the way that fits.
- Cloud API
Kandaro reads from the vendor’s cloud. Nothing to install.
- Kandaro Connect
A small container on your network that only connects out. Adds research and response.
What Kandaro needs
What you set up once.
- QRadar on Cloud: an authorized service token that may read offenses.
- QRadar on your network: Kandaro Connect.
SIEMs
More tools like this.
Wazuh
Reads every Wazuh alert into cases, and blocks addresses or isolates Linux machines through Wazuh’s own responses.
- Alerts in
- Research
- Respond
- Quick push
- Kandaro Connect
Splunk
Reads notable events or a saved search into cases, and can send Kandaro’s findings back to Splunk.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Elastic Security
Reads Elastic Security alerts into cases, and can write Kandaro’s findings to a data stream.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Connect IBM QRadar to Kandaro SOC.
Request early access to Kandaro SOC, or start a 14-day trial of Kandaro Deception today.
Deception trial: card required · cancel before day 14 and pay nothing