Wipro Holmes for Cyber Defense

Today’s Cybersecurity Analysts are able to identify False Positive triggers from SIEM (security information and event management) system only after investigating the offense. Hence, unable to focus actual threats on daily basis. Also majority of the offenses are False Positive, therefore more time is spent in investigating the false threats and the system enhancement becomes difficult for the domain experts.

The objective is to identify the false positive and true positive alerts raised from SIEM (Q-Radar system) and to improve the cyber defense process with Advance AI capabilities with greater accuracy.

About Solution:

Wipro Holmes Reimagining Cyber-defense process is a AI solution to identify the root cause for False Positive alerts and provides AI guided insights to cyber security analysts to reduce time & effort to focus on actual alerts and reduce the associated risk of missing threat due to pipeline issues. Also, enabling the team with inferences to significantly reduce manual efforts & human errors thus regaining associated benefits of time for more productive activities. Microsoft Workloads such as Azure Blob storage for storing the data from SIEM tools (QRadar) and IP reputation data, Azure Active Directory for user validation, Azure ML Studio for ML pipelines for build, deploy & monitor the AI models (the complete MLOps to automate & accelerate the machine learning lifecycle) and Azure Compute - container/cluster instance - For model training, Azure inference for real time inference.

Key features:

• Identifies false alerts due to data inconsistency with greater accuracy
• Empowers Cyber-Security Analysts with Inferences to close the incidents or offenses
  
• Reduces associated risk by correctly identifying the alerts which the existing tool misses out
  
• Standalone System – Easily pluggable to existing device as well as on any new devices
  
  

• Provide inferences on root cause of false positive.
• Incorporate dynamicity of data and use-case.
• More rapidly offense investigation.
• Significantly reduces the time and effort in investigation