Try our new research platform with insights from 80,000+ expert users

Amazon OpenSearch Service vs IBM Security QRadar comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024
 

Categories and Ranking

Amazon OpenSearch Service
Ranking in Log Management
47th
Average Rating
7.4
Reviews Sentiment
7.3
Number of Reviews
3
Ranking in other categories
Application Performance Monitoring (APM) and Observability (54th)
IBM Security QRadar
Ranking in Log Management
6th
Average Rating
8.0
Reviews Sentiment
7.5
Number of Reviews
204
Ranking in other categories
Security Information and Event Management (SIEM) (4th), User Entity Behavior Analytics (UEBA) (1st), Endpoint Detection and Response (EDR) (18th), Security Orchestration Automation and Response (SOAR) (4th), Managed Detection and Response (MDR) (10th), Extended Detection and Response (XDR) (14th)
 

Featured Reviews

VijayKumar27 - PeerSpot reviewer
Effective as a vector store, serverless architecture but there aren't enough security features
The pricing aspect is a concern. The service is way too costly. For the past month, I used only 30 to 40 MB of data, and the cost was $500. AWS could improve pricing. Even being serverless, it incurs charges during idle times. For just holding data, you need to create a list. AWS should add an option to make data idle, so it won't include computing charges. They charge for OCU units based on the time the serverless solution is up, not on indexing or retrieval speed. Once the service starts, it starts getting billed. It would help if there were an option to limit computing. When using it as a database, storing data without frequent fetching would save computing costs.
Muzzamil Hussain - PeerSpot reviewer
Is easy to integrate and doesn't require maintenance
One major drawback we are facing is in the area of IBM Security QRadar integration with flat file databases. IBM Security QRadar does not support flat file database integration. We are currently facing an issue with respect to the database, which you normally call a NoSQL database. There is no direct integration mechanism available with IBM Security QRadar. We have to approach IBM and generate a ticket so that they can develop a custom method for the integration. In database integration, we are facing issues with IBM Security QRadar. The solution does not support the integration of flat file databases. Certain organizations have flat file databases. IBM does not support direct integration with some databases. We had to create a plug, and we requested IBM to develop a parser, but it is taking IBM a couple of months to develop it. I think a flat-file database should be supported directly instead of developing a parser plugin. There should be a more refined threat intelligence platform, and cross-integration should be possible with locally available threat intelligence platforms.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Amazon OpenSearch Service has enhanced our organization's ability to store and search large amounts of data efficiently."
"We retrieve historical data with just a click of a button to move it from cold to hot or warm because it's already stored in the backend storage"
"This service already sorts data like vectors. They have classified the storage pre-defined."
"Amazon OpenSearch Service provides a managed database solution, so we don't need to manage everything ourselves."
"The tool helps with infrastructure, application, and network monitoring."
"It has a logical, user-friendly GUI."
"The tool's most valuable feature is log source management. It enables us to connect to various log sources, including content, authentications, or other customized integrations. These integrations can be tailored for use with other platforms that don’t already have built-in IBM add-ons."
"This solution provides me with various alarms, and I have found security issues with some of my other products."
"The features that I have found most valuable are that it is very stable, easy to get going, and easy to manage. It is also easy to review all incidents."
"The most valuable feature is the integration with the GRD, for banking."
"What I like the most about it is that you can very easily install and configure it. As compared to other SIEM solutions, for which you need to know and do a lot more to prepare your SIEM environment, QRadar is much simpler to install and configure. There are various options in the Admin console. In the Admin tab, you can design dashboards and view various graphs. It has a lot of attractive features, and you don't need to configure everything on your own."
"Stability-wise, I rate the solution a ten out of ten."
 

Cons

"One improvement I would like to see is support for auto-scaling."
"One improvement I would like to see is support for auto-scaling."
"The pricing aspect is a concern. The service is way too costly. For the past month, I used only 30 to 40 MB of data, and the cost was $500. AWS could improve pricing."
"It would be beneficial to have some level of customization available in the managed service, tailored to the specific use cases of the end users."
"I'd like them to improve the offense. When QRadar detects something, it creates what it calls offenses. So, it has a rudimentary ticketing system inside of it. This is the same interface that was there when I started using it 12 years ago. It just has not been improved. They do allow integration with IBM Resilient, but IBM Resilient is grotesquely expensive. The most effective integration that IBM offers today is with IBM Resilient, which is an instant response platform. It is a very good platform, but it is very expensive. They really should do something with the offense handling because it is very difficult to scale, and it has limitations. The maximum number of offenses that it can carry is 16K. After 16K, you have to flush your offenses out. So, it is all or nothing. You lose all your offenses up until that point in time, and you don't have any history within the offense list of older events. If you're dealing with multiple customers, this becomes problematic. That's why you need to use another product to do the actual ticketing. If you wanted the ticket existence, you would normally interface with ServiceNow, SolarWinds, or some other product like that."
"The product does not have a team for investigating malware."
"Technical support is good, but not great."
"For future updates, I'd like to see more advanced threat intelligence features integrated with AI. This would help with analyzing traffic patterns and improving protection. QRadar currently doesn't integrate with AI for threat analysis. However, AI could enhance its capabilities by learning traffic patterns and automatically blocking or quarantining suspicious traffic. This would be especially useful when administrators are not actively monitoring. AI could help by analyzing incoming and outgoing traffic and adjusting policies accordingly."
"I would like to see the update process simplified."
"QRadar's performance has room for improvement because it cannot handle the volume. I need massive amounts of logs from various devices in our existing network architecture. IBM needs to improve QRadar's capacity to handle more logs."
"Maybe there should be more custom rules in the exchange. Basically, we are using a lot of threat rules, so maybe they'll develop something like that."
"What needs to be improved in IBM QRadar User Behavior Analytics is the user experience. It's not optimal. Some screens are a bit clunky. The solution needs to be more user-friendly."
 

Pricing and Cost Advice

Information not available
"You have a one-time payment, and you also can purchase it for one year as a subscription. We have it on-premise, and we have a permanent license for it. We have to pay for the support on a yearly basis. If you compare its cost with Sentinel for one year, QRadar would seem more expensive, but if you compare its cost over five or ten years, Azure Sentinel will be more expensive than QRadar. If you compare its cost with Sentinel for one year, QRadar would seem more expensive, but if you compare its cost over five or 10 years, Azure Sentinel can be more expensive than QRadar."
"The solution's pricing is based on the EPS model."
"The product is expensive. We have purchased the perpetual license, but we pay for the support."
"QRadar is quite expensive. It wouldn't be worth it for a small business..."
"There are different types of subscriptions available. We were on an annual subscription, but our customers typically choose the two years subscription option."
"There is a license required for this solution."
"IBM has subscriptions plans that run for one year."
"It's very expensive but it fits our budget."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
816,406 professionals have used our research since 2012.
 

Comparison Review

VS
Jun 28, 2015
Qradar vs. ArcSight
Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Computer Software Company
11%
Manufacturing Company
8%
Government
6%
Educational Organization
23%
Computer Software Company
14%
Financial Services Firm
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about Amazon OpenSearch Service?
We retrieve historical data with just a click of a button to move it from cold to hot or warm because it's already stored in the backend storage
What is your experience regarding pricing and costs for Amazon OpenSearch Service?
The pricing is way too costly. I used it for around 40 MB of data for a month, and it cost $500. Even when idle, it continues to incur charges. They could improve this by allowing us to limit compu...
What needs improvement with Amazon OpenSearch Service?
The pricing aspect is a concern. The service is way too costly. For the past month, I used only 30 to 40 MB of data, and the cost was $500. AWS could improve pricing. Even being serverless, it incu...
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendlier GUI and are not licensed based on capacity (amount of logs and information in...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What do you like most about IBM QRadar?
The event collector, flow collector, PCAP and SOAR are valuable.
 

Also Known As

No data available
IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar, IBM QRadar User Behavior Analytics, IBM QRadar Advisor with Watson
 

Learn More

Video not available
 

Overview

 

Sample Customers

Information Not Available
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.
Find out what your peers are saying about Amazon OpenSearch Service vs. IBM Security QRadar and other solutions. Updated: October 2024.
816,406 professionals have used our research since 2012.