Who does what
Provider
- Investigate contracted alerts 24/7
- Automate triage and agreed response workflows
- Maintain shared detection and playbook workflows
Your team
- Approve rules and automation thresholds
- Define actions and maintain tool access
- Handle out-of-scope recovery
Coverage
- Endpoints
- Cloud Workloads
- Network
- OT/ICS
Details
Service scope
Best for Teams with an existing SOC stack that want shared detection and response operations
AI tasks
ATOM supports triage, investigation plans and response workflows. IBM analysts handle escalations and complex investigation.
Shared control
Customers approve detection changes and define response playbooks. Agree action permissions per connected tool.
Current packages
TDR continues under IBM. QRadar SaaS migration, TDR Cloud Native and broader Autonomous Security entitlements need separate checks.
Full service analysis
IBM Threat Detection and Response Services combines 24/7 analyst investigation, AI triage and response playbooks across your existing tools. Your team retains detection-rule approvals, automation thresholds, tool access and recovery outside the agreed response scope.
- Your team owns
- Approve detection changes and automation thresholds
- Define permitted response actions and maintain tool access
- Handle recovery and business decisions outside the contracted response scope
Operational AI and oversight
ATOM enriches alerts, builds investigation plans and can execute response workflows. The Cybersecurity Assistant also runs queries, retrieves logs and recommends actions. IBM analysts remain part of delivery. Document the boundary between automatic closure, analyst investigation and actions requiring your approval.
Shared SOC workflow
IBM documents customer-approved detection rules, client-defined alert confidence levels and shared response playbooks. SOAR and API integration connect IBM outcomes to the buyer’s workflow. Confirm the available controls for your chosen platform and contract.
QRadar ownership boundary
Palo Alto Networks acquired QRadar SaaS assets and published 2026 end-of-life dates for the affected products. IBM continues to market TDR. A legacy QRadar SaaS or endpoint-MDR listing does not establish the platform, price or entitlement in a new TDR order.
Package boundary
TDR Cloud Native names Microsoft security tools. ATOM also has Google SecOps and Palo Alto integrations. Broader Autonomous Security services and X-Force proactive work need their own scope. Confirm incident-response activation and charges rather than assuming unlimited recovery.
Pricing & contract
- Billing
- Custom
Scope TDR service fees, platform licenses, ingestion and retention, ATOM capabilities and X-Force incident-response terms separately.
Tradeoffs & buying questions
Strengths
-
Works across an existing security stack
-
Customer controls over detection and response workflows
-
Operational AI beyond ticket summaries
Considerations
-
Automation authority depends on the contracted tool and playbook
-
QRadar SaaS migration and TDR service terms need separate checks
-
Broader Autonomous Security and proactive services need explicit scope
Ask before buying
- Which ATOM actions run automatically? Which need an analyst or our approval and who can stop or reverse them?
- Which platform licenses, ingestion, retention, exports and X-Force response hours are included in this TDR order?
- Who owns support, tenant administration and renewal if we buy through a partner or migrate a QRadar SaaS deployment?
Integrations
Platform / SIEM
- Microsoft Sentinel (TDR Cloud Native)
- Google SecOps (ATOM integration)
- Palo Alto Cortex XSIAM (scoped delivery)
Endpoint
- Microsoft Defender XDR (TDR Cloud Native)
Other integrations
- IBM ATOM / Consulting Advantage
- SOAR-to-SOAR and API workflows
- Microsoft Defender for Cloud (TDR Cloud Native)
Common questions
Does ATOM remove the need for human oversight?
IBM combines agentic automation with security analysts. Agree the permitted actions, confidence thresholds and escalation rules for your deployment.
Was IBM TDR sold with QRadar SaaS?
The acquisition covered QRadar SaaS assets. IBM continues to offer TDR and delivery around partner platforms. Check affected SaaS migrations separately.
Does TDR include every IBM security service?
No. Name the TDR platform, ATOM functions and X-Force entitlements in the order. Broader Autonomous Security work needs separate scope.