Security and Compliance
Cal Poly Pomona needed to manage an enormous campus network, rising alert volumes, and multiple compliance obligations without overwhelming a small IT security team.
Reported impact
Cal Poly Pomona gained faster threat detection, simpler auditing and compliance support, and a much smaller pool of daily alerts for investigation, while also creating hands-on cybersecurity learning opportunities.
Cal Poly Pomona deployed IBM Security QRadar SIEM as a centralized security information and event management platform for a campus environment with more than 84,000 monitored devices. After choosing QRadar, IBM Security and university staff inventoried the architecture, documented network topology, and identified user roles with data access so alerts could be interpreted in context across police, healthcare, retail, and student systems. QRadar then centralized, normalized, and analyzed roughly 44 GB of logs and reports per day using machine learning, behavior analytics, and actionable alerting to surface suspicious activity rather than flooding staff with raw events. The platform also feeds an isolated SOC environment in the Mitchell Hill Data Center where students observe traffic and simulate issues. The result is a single monitoring layer that supports threat detection, incident response, auditing, compliance, and security education across the university.
Logs from campus devices, wireless infrastructure, and regulated systems flow into QRadar SIEM, where events are centralized, normalized, and analyzed with behavior analytics before actionable offenses are surfaced to security staff and, in the training environment, to students running the SOC.
"QRadar SIEM empowers Cal Poly Pomona to centralize, normalize and analyze incoming data from over 84,000 devices"
"We were getting so many device alerts that it could soon become overwhelming."
"With QRadar we quickly identified and reconfigured these systems in that same week."
"the solution routinely narrows potential alerts each day to between 20 and 40 actionable items"
"this generates roughly 44 GB of logs and reports each day"
Review how this reference was scored and trace each normalized claim back to its documented source.
Scoring methodology
Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.
Traceability
Field coverage shows which facts each source supports. Dates are shown only when documented by the source.
Related
Databricks Sample Mar 20, 2026 Baylor University Enrollment Management Baylor's Enrollment Management division serves 19,000 students and 50,000 annual applications, with a small contact-center team handling 100–300 calls per day about financial aid and student accounts. Dedicated QA could… 100% call review coverage (up from ~5%) Agent Bricks / Mosaic AI · Databricks Genie · Databricks Marketplace 
IBM Sample Oct 30, 2025 Citi Citi wanted to modernize internal audit so thousands of auditors could review documents, assess risk and surface anomalies faster than was possible with manual methods. 2,500 auditors IBM Cloud Pak for Data · IBM OpenPages · IBM Watson Discovery IBM Sample Oct 15, 2025 IBM Tax Organization IBM's tax organization needed to automate global compliance work because inaccessible and incomplete data made tax-return preparation and document validation too manual across many countries and source systems. 3 use cases on track to save tens of thousands of hours annually EY.ai for tax · IBM watsonx.ai · IBM watsonx.data 