IBM Security QRadar Reviews

Vendor: IBM

4.0 out of 5

207 reviews
90% willing to recommend

6,938 followers

What is IBM Security QRadar?

IBM Security QRadar (recently acquired by Palo Alto Networks) is a security and analytics platform designed to defend against threats and scale security operations. This is done through integrated visibility, investigation, detection, and response. QRadar empowers security groups with actionable insights into high-priority threats by providing visibility into enterprise security data. Through centralized visibility, security teams and analysts can determine their security stance, which areas pose a potential threat, and which areas are critical. This will help streamline workflows by eliminating the need to pivot between tools.

Get the IBM Security QRadar Buyer's Guide and find out what your peers are saying about IBM Security QRadar, CrowdStrike Falcon, Wazuh and more!

IBM Security QRadar is the #1 ranked solution in top User Entity Behavior Analytics (UEBA) solutions, #4 ranked solution in top Security Information and Event Management (SIEM) solutions, #4 ranked solution in SOAR tools, #6 ranked solution in Log Management Software, #10 ranked solution in top Managed Detection and Response (MDR) solutions, #12 ranked solution in XDR Security products, and #18 ranked solution in EDR tools. PeerSpot users give IBM Security QRadar an average rating of 8.0 out of 10. IBM Security QRadar is most commonly compared to CrowdStrike Falcon: IBM Security QRadar vs CrowdStrike Falcon. IBM Security QRadar is popular among the large enterprise segment, accounting for 44% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a educational organization, accounting for 24% of all views.

Helped 833,335 peers since 2012

Featured reviews

Md. Shahriar Hussain

Information Security Analyst at Banglalink

There are many types of AI, and this AI is very limited in SQL and features. There may be potential for improvement. So far, it seems very limited. It shows some good features in the correlation part, but I think there is room for improvement. For instance, when creating rules, it can suggest more rules, reducing the effort needed. If AI-related support can suggest rules and integrate with existing security devices like MD, IPS, this SIM can create more relevant rules. Sometimes logs I receive don't mean anything, and I need technical stakeholders to share or forward logs, but these are sometimes inadequate. Keywords can help identify insufficient logs. I often lack time to verify logs. Sharing false positive results could be reduced to help my team.

Read full review

VuralSanal

Network and Security Architect at Deutsche Telekom

I think there is room for improvement with correlations in QRadar, especially in terms of customer logs. We receive logs from different types of devices and need a way to correlate them effectively. This would help identify critical or high-priority alarms in QRadar. Perhaps we are missing parameters in QRadar and need to double-check to enhance functionality.

Read full review

Maaz Khalid

Manager SOC at Rewterz

The initial setup is user-friendly and straightforward, making deployment easy. However, compatibility issues with other security controls still need to be addressed. It provides a 35-day period for project enablement. This timeframe is too short and should be extended to 45 or 50 days. When deploying QRadar on-premises, we assess the organization's size to determine the required number of UPS units, application servers, and other necessary hardware. Once these requirements are identified, we proceed with the deployment. We face challenges in the deployment phase, especially when working with an MSSP license. The main issue is with QRadar's multi-tenancy, which often causes the system to crash. Their support services are not very helpful in addressing these problems. We allocate two working days for the deployment of QRadar for our customers. Our team includes a senior engineer who communicates with the client and a junior engineer responsible for deploying and installing other services. The deployment time can vary based on the size of the setup. Large deployments, such as those with 20,000 to 25,000 EPS for corporate clients, take longer due to the need for multiple hardware servers. In such cases, it can take several days. QRadar can be installed in about three to four hours for smaller setups.

Read full review

IBM Security QRadar mindshare

Product category:

As of February 2025, the mindshare of IBM Security QRadar in the Security Information and Event Management (SIEM) category stands at 8.9%, down from 9.7% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

PeerAnalyst reports

Type	Title	Date
Category	Security Information and Event Management (SIEM)	Feb 16, 2025	Download
Product	Reviews, tips, and advice from real users	Feb 16, 2025	Download
Comparison	IBM Security QRadar vs Splunk Enterprise Security	Feb 16, 2025	Download
Comparison	IBM Security QRadar vs Wazuh	Feb 16, 2025	Download
Comparison	IBM Security QRadar vs Microsoft Sentinel	Feb 16, 2025	Download

Title	Rating	Mindshare	Recommending
CrowdStrike Falcon	4.3	4.4%	96%	125 interviews Add to research
Wazuh	3.7	15.0%	79%	45 interviews Add to research

Valuable Features

IBM Security QRadar excels in data extraction, scalability, and ease of use. It supports automatic log source identification and offers custom parsers. Key features include comprehensive dashboards, compliance monitoring, threat intelligence, and a robust correlation engine. Integration with Watson enhances threat detection and user behavior analytics. QRadar provides real-time alerts and customizable rules, ensuring minimal false positives. Its user-friendly interface and effective integration capabilities make it a top choice for managing security events and offenses.

"The dashboard is easy to use and easy to understand what's going on and what the alerts mean."
"My overall rating for this solution is nine out of ten."
"I think QRadar is stable and currently satisfies my needs."

Room for Improvement

IBM Security QRadar needs improvements in user interface for better usability, enhanced integration with other tools, and more APIs for seamless data exchange. Users express the need for advanced analytics and reporting capabilities. The management of alerts and vulnerabilities requires refinement. Better support and competitive pricing are desired. Enhanced automation, real-time processing, and easier configuration of security parameters are recommended to boost effectiveness and user satisfaction. Users also seek more scalable and versatile cloud integration.

"There are many types of AI, and this AI is very limited in SQL and features. There may be potential for improvement."
"We sometimes experience downtime, but it depends on the version. There is some variability."
"Improving the integration with IBM Server for MetaMask for correlation rules would be beneficial. Currently, I use Sentinel in Azure, and I would prefer creating one rule to roll it out to both Sentinel and QRadar. However, this is not possible because QRadar lacks this capability."

ROI

IBM Security QRadar has been praised for coming in under budget and its ability to provide substantial value, which some believe offers a good ROI. Users note its reasonable cost, efficient operation without excessive staffing, and a strong advantage in market share. Despite the lack of a concrete ROI calculation, clients consider it valuable for security monitoring and have observed positive ROI indicators, especially in user behavior analytics and resource optimization. Long-term benefits include security threat mitigation and organizational resilience.

Pricing

Enterprise users of IBM Security QRadar note it as a highly efficient yet expensive solution with complex licensing based on events per second (EPS) and flows per minute. Many appreciate its cost-effectiveness compared to similar products like Splunk, but small businesses might find its pricing prohibitive. Discounts and subscription options are available, and the latest licensing model has simplified the process. Additional costs exist for services and infrastructure, necessitating careful planning and negotiation.

"As for licensing costs, I haven't seen the exact figures, but it is considered somewhat costly. On a scale from one to ten, where one is very expensive and ten is very cheap, I would rate it a six—it’s costly but worth the money."
"The tool is priced in a competitive manner. The tool's price is dependent on the installation and the product size, but it is competitive in the marketplace."
"The tool's price is high."

Popular Use Cases

Organizations primarily use IBM Security QRadar for real-time threat detection, compliance, and incident management. They integrate it in sectors like banking and telecom for Security Information and Event Management (SIEM), analyzing logs, monitoring security events, and ensuring data security. QRadar offers analytics for user behavior, manages compliance like PCI, and facilitates endpoint integration, helping companies enhance security posture while managing and correlating logs from diverse security devices.

Service and Support

IBM Security QRadar's customer service is praised for its responsiveness and knowledgeable technical support, though experiences vary. Users find regional service inconsistent, with delays in some locations. High-level support excels, while initial responses can be sluggish. The community documentation is noted as helpful, although some find it outdated. Users value 24/7 availability but suggest improvement in response times. Many benefit from good relationships with IBM, reporting faster resolutions when engaging the right personnel.

Deployment

Many users find IBM Security QRadar's initial setup straightforward, likening it to a simple installation of an operating system. The setup process can be quick, especially with the ISO file for component installation. However, complexity arises in fine-tuning and integrating log sources, requiring technical expertise. Some report needing external support. Deployment time varies based on organizational infrastructure, with some needing additional time for configuration and customization. Overall, experiences range from easy to complex.

Scalability

IBM Security QRadar demonstrates impressive scalability, with users noting its adaptability and ability to manage increased workloads easily. Whether vertically or horizontally, entities find it straightforward to expand capacity by adding licenses or hardware. Many praise its cloud-based flexibility, ease of integration with distributed architecture, and the ability to handle numerous events per second. While most report excellent scalability, some mention challenges in on-premises environments and cost considerations. Generally, organizations rate its scalability favorably.

Stability

IBM Security QRadar shows strong stability when properly configured and sized for the environment, though some have experienced issues with updates or patches. Users report occasional bugs and glitches but generally find it reliable. The platform is praised for its high availability, with some attributing issues to external factors like network configurations. Stability varies based on deployment specifics, but many organizations find it stable and effective for their needs.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our IBM Security QRadar Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Educational Organization

24%

Computer Software Company

14%

Financial Services Firm

10%

Manufacturing Company

Government

University

Healthcare Company

Comms Service Provider

Energy/Utilities Company

Retailer

Insurance Company

Media Company

Construction Company

Real Estate/Law Firm

Hospitality Company

Non Profit

Transportation Company

Outsourcing Company

Wholesaler/Distributor

Legal Firm

Recreational Facilities/Services Company

Performing Arts

Consumer Goods Company

Pharma/Biotech Company

Compare IBM Security QRadar with alternative products

Learn more about IBM Security QRadar

IBM Security QRadar is built to address a wide range of security issues and can be easily scaled with minimal customization effort required. As data is ingested, QRadar administers automated, real-time security intelligence to swiftly and precisely discover and prioritize threats. The platform will issue alerts with actionable, rich context into developing threats. Security teams and analysts can then rapidly respond to minimize the attackers' strike. The solution will provide a complete view of activity in both cloud-based and on-premise environments as a large amount of data is ingested throughout the enterprise. Additionally, QRadar’s anomaly detection intelligence enables security teams to identify any user behavior changes that could be indicators of potential threats.

IBM QRadar Log Manager

To better help organizations protect themselves against potential security threats, attacks, and breaches, IBM QRadar Log Manager gathers, analyzes, preserves, and reports on security log events using QRadar Sense Analytics. All operating systems and applications, servers, devices, and applications are converted into searchable and actionable intelligent data. QRadar Log Manager then helps organizations meet compliance reporting and monitoring requirements, which can be further upgraded to QRadar SIEM for a more superior level of threat protection.

Some of QRadar Log Manager’s key features include:

Data processing and capture on any security event
Disaster recovery options and high availability
Scalability for large enterprises
SoftLayer cloud installation capability
Advanced threat protection

Reviews from Real Users

IBM Security QRadar is a solution of choice among users because it provides a complete solution for security teams by integrating network analysis, log management, user behavior analytics, threat intelligence, and AI-powered investigations into a single solution. Users particularly like having a single window into their network and its ability to be used for larger enterprises.

Simon T., a cyber security services operations manager at an aerospace/defense firm, notes, "The most valuable thing about QRadar is that you have a single window into your network, SIEM, network flows, and risk management of your assets. If you use Splunk, for instance, then you still need a full packet capture solution, whereas the full packet capture solution is integrated within QRadar. Its application ecosystem makes it very powerful in terms of doing analysis."

A management executive at a security firm says, "What we like about QRadar and the models that IBM has, is it can go from a small-to-medium enterprise to a larger organization, and it gives you the same value."

IBM Security QRadar was previously known as IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar, IBM QRadar User Behavior Analytics, IBM QRadar Advisor with Watson.