Security and Compliance
boxxe needed to detect and respond to faster-moving cyber threats across diverse customer environments without overloading its security analysts or relying on fragmented dashboards and manual reporting.
Reported impact
boxxe reduced response times, cut manual reporting work, consolidated analyst tooling, and improved its ability to detect and mitigate sophisticated threats across customer environments.
boxxe modernized its security-operations workflow with IBM Security QRadar SIEM on Cloud and IBM Security QRadar SOAR. QRadar's user behavior analytics applies machine learning to identify abnormal login behavior and other threats earlier than boxxe's prior manual rules, while SOAR and the unified analyst experience help analysts investigate, cross-reference, escalate, and threat-hunt from a smaller set of consolidated dashboards. The team deployed UBA in a multitenant architecture and activated more than 1,500 rules, allowing the platform to learn in the background and tune detection thresholds with minimal analyst input. QRadar's federated search also reaches into external platforms and returns filtered results into one pane of glass, which helped boxxe shrink 14 dashboards to three with a goal of one. That architecture gives the SOC broader visibility, faster detection, and lower operational overhead across managed customer environments.
Security telemetry from customer systems is ingested into QRadar SIEM, where UBA and machine-learning analytics score risky behavior, federated search brings in context from other platforms, and QRadar SOAR helps analysts escalate and remediate threats from the same operating environment.
IBM Security QRadar SIEM on cloud, combined with IBM Security QRadar SOAR, offered the best advantages for today’s security challenges.
Mean time to resolution (MTTR): 60% reduction, from 35 minutes to 14 minutes
The team has deployed UBA in a multitenant architecture and activated more than 1,500 rules, and has gotten only one false positive.
Within five minutes, UBA detected abnormal logins and began increasing the activity’s risk score
eliminate about 20 hours per month of manual reporting
Review how this reference was scored and trace each normalized claim back to its documented source.
Scoring methodology
Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.
Traceability
Field coverage shows which facts each source supports. Dates are shown only when documented by the source.
Related
IBM Sample Sep 11, 2025 Lenovo PCCW Solutions (LPS) LPS needed a more unified way to monitor, secure, and scale hybrid environments for enterprise clients because its existing monitoring tools only offered siloed snapshots and could not support proactive incident… 24×7 service-level commitments IBM Instana · IBM LinuxONE · IBM Turbonomic IBM Sample Aug 1, 2024 CarbonHelix CarbonHelix needed to deliver highly customized managed security services across diverse customer environments while improving threat-detection speed and accuracy beyond what human analysts and manual workflows could… 24x7 security operations center (SOC) services IBM Guardium · IBM QRadar SOAR · IBM QRadar Suite IBM Sample Jul 12, 2024 Sanwa Comtec K.K. Sanwa Comtec needed to add AI-based harassment detection to on-premises chat deployments for customers that cannot send sensitive conversations to external networks, while still achieving enough accuracy to make alerts… > 95％ accuracy of AI-based harassment judgments in closed networks IBM Watson natural language processing · IBM watsonx.ai 