Try our new research platform with insights from 80,000+ expert users

ArcSight Analytics vs IBM Security QRadar comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

ArcSight Analytics
Ranking in User Entity Behavior Analytics (UEBA)
14th
Average Rating
7.0
Reviews Sentiment
6.6
Number of Reviews
15
Ranking in other categories
No ranking in other categories
IBM Security QRadar
Ranking in User Entity Behavior Analytics (UEBA)
1st
Average Rating
8.0
Reviews Sentiment
7.5
Number of Reviews
204
Ranking in other categories
Log Management (6th), Security Information and Event Management (SIEM) (4th), Endpoint Detection and Response (EDR) (18th), Security Orchestration Automation and Response (SOAR) (4th), Managed Detection and Response (MDR) (10th), Extended Detection and Response (XDR) (14th)
 

Mindshare comparison

As of November 2024, in the User Entity Behavior Analytics (UEBA) category, the mindshare of ArcSight Analytics is 1.5%, up from 1.4% compared to the previous year. The mindshare of IBM Security QRadar is 13.8%, down from 18.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
User Entity Behavior Analytics (UEBA)
 

Q&A Highlights

Navin Rehnius - PeerSpot reviewer
Aug 10, 2021
 

Featured Reviews

Syed Ubaid Ali Jafri - PeerSpot reviewer
It has improved our system and network policy monitoring
They should improve on the following: * Timely resolution of issues and proper support once a ticket has been generated. * Systems appearing on the network which are not part of the domain controller. These should be monitored. * Inactive connections from servers, which are upgraded or downgraded within a VM, should be automatically revoked. * Logger monitoring should be separated from ESM monitoring. * Ability to integrate with cloud-based applications and monitor cloud-based events. * Ability to log and notify tailored rules via SMS/email. * Provide more ArcSight training and workshops.
Muzzamil Hussain - PeerSpot reviewer
Is easy to integrate and doesn't require maintenance
One major drawback we are facing is in the area of IBM Security QRadar integration with flat file databases. IBM Security QRadar does not support flat file database integration. We are currently facing an issue with respect to the database, which you normally call a NoSQL database. There is no direct integration mechanism available with IBM Security QRadar. We have to approach IBM and generate a ticket so that they can develop a custom method for the integration. In database integration, we are facing issues with IBM Security QRadar. The solution does not support the integration of flat file databases. Certain organizations have flat file databases. IBM does not support direct integration with some databases. We had to create a plug, and we requested IBM to develop a parser, but it is taking IBM a couple of months to develop it. I think a flat-file database should be supported directly instead of developing a parser plugin. There should be a more refined threat intelligence platform, and cross-integration should be possible with locally available threat intelligence platforms.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"One of the most valuable features is the alerts."
"The ability to correlate different logs is the solution's most valuable feature."
"This solution makes it easy to create use cases, and it is easy to move queries from use cases to the report to the dashboard."
"ArcSight Analytics is used to get a deeper insight and threat analysis about the network."
"The most valuable features are that you get lots of connectors, which make it easy to log in to my ASM, and lots of prebuilt roles from the company."
"The two most valuable features of this solution are its stability and scalability."
"The solution is easy to implement."
"The data collection and the integration with different products are valuable features."
"The most valuable feature is user behavior analytics (UBA)."
"No doubt about it, the solution is extremely stable."
"It integrates very easily with other solutions. The solution is flexible. We can add anything to it, as it is a good companion to other tools."
"There is a single dashboard that gives us a complete overview of what is happening around the globe."
"The feature that I have found most valuable is its artificial intelligence component, Watson. Its contribution is pretty good from a machine-learning artificial intelligence perspective. This compliments the orchestration automation component, as well."
"What I like about IBM QRadar User Behavior Analytics is that it uses machine learning algorithms to generate risk scoring for the user activity. I also like that it syncs with our Active Directory users, so it really has full coverage for all users in our environment."
"It provides many options for searching. I can see devices from different vendors, like Cisco, in one interface, which is good for me."
"It is really helpful to us from the compliance point of view."
 

Cons

"Network integration is very crucial, and you need to have the knowledge to get it done."
"The interactive dashboard is complicated and you need to have training in order to use it, so I think that it could be made easier to use."
"It's a difficult product to navigate, it's complex."
"Currently, there are no compatible connectors for this solution, which means we have to depend on FlexConnectors."
"I faced stability issues with Windows Operating System. The installed connectors hang if they remain idle for a long period of time."
"It needs more user analytics and aggregation user queries. And it's slow. When you query over ArcSight, it is very slow."
"The customer service could be improved, and additional integrations with other APIs could be added."
"Their support team could be better."
"There should be an extension where we can get the reports. This could be an extension to the dashboard with the Guardian or another product with limited technology, for example IPS. Now, we only have IBM. Basically, it needs more and more integration models."
"IBM Qradar could improve the reporting. The tool is not designed to report. It's a great operational monitoring tool. You put it on a screen and you watch it. If you want to have analytics out of it, that's a whole different story. You're going to need more people and tools. What should be added is reporting and integration into Power BI, into some capability that produces analytical reports from the source data. IBM does not seem to care to add these features."
"It is very difficult to activate all of the network equipment, and it would help if it were made easier."
"IBM QRadar could improve the plugins and threat detection."
"The threat detection needs improvement, they have many false positives."
"They should speed up the incident response and also, at the same time, reduce the amount of manual effort that is required."
"I would like the rule creation interface to be much more user-friendly in the next release."
"I would like to see some artificial intelligence and alternative solutions."
 

Pricing and Cost Advice

"In addition to the costs of standard licensing fees, there is the cost of labor for maintenance."
"The monthly licensing fee is around $20,000. There aren't any costs in addition to the standard licensing fee."
"This solution is expensive."
"My customers pay a yearly licensing fee for ArcSight Analytics."
"ArcSight Analytics is a bit expensive compared with other tools in terms of licensing costs, training, hardware implementation, and support."
"It can range between $30,000 and $40,000 USD, and can go up to $500,000 and $600,000 USD."
"The tool is priced in a competitive manner. The tool's price is dependent on the installation and the product size, but it is competitive in the marketplace."
"The solution is priced fairly, there is a license for the solution, and we pay annually."
"On a scale of one to ten, I rate the price a one, where one is an extremely expensive product, and ten is a cheap product."
"It's too expensive. The licensing is also a little bit difficult to understand because you have to license it per event and per number of flows."
"IBM Security QRadar is a very expensive tool."
"It's not expensive for the resources that it gives you."
"When it comes to the initial pricing there can be a huge discount from there side and also I think they are open to competing with other products."
"Only enterprise businesses can afford the tool."
report
Use our free recommendation engine to learn which User Entity Behavior Analytics (UEBA) solutions are best for your needs.
816,406 professionals have used our research since 2012.
 

Comparison Review

VS
Jun 28, 2015
Qradar vs. ArcSight
Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…
 

Answers from the Community

Navin Rehnius - PeerSpot reviewer
Aug 10, 2021
Aug 10, 2021
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, remember that any EDR/XDR should integrate to the SIEM/SOAR and a strong threat intel source. If you consider SOC outsourcing take your time and find one you can integrate like a virtual team member. They a...
2 out of 12 answers
KM
Jul 26, 2021
I haven't used these big-name ones like Splunk etc. but I feel they're overpriced. I think they charge an arm and a leg for each module. The ROI justification is not there. Why not try a cheaper and robust alternative like Elasticsearch?
KA
Jul 26, 2021
We are using LogRthythm SIEM complete case management and offer SIEM/SOC as service.
 

Top Industries

By visitors reading reviews
No data available
Educational Organization
23%
Computer Software Company
14%
Financial Services Firm
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What do you like most about ArcSight Analytics?
ArcSight Analytics is used to get a deeper insight and threat analysis about the network.
What is your experience regarding pricing and costs for ArcSight Analytics?
My customers pay a yearly licensing fee for ArcSight Analytics.
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendlier GUI and are not licensed based on capacity (amount of logs and information in...
What do you like most about IBM QRadar?
The event collector, flow collector, PCAP and SOAR are valuable.
 

Also Known As

ArcSight User Behavior Analytics, ArcSight UBA
IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar, IBM QRadar User Behavior Analytics, IBM QRadar Advisor with Watson
 

Learn More

 

Overview

 

Sample Customers

Information Not Available
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.
Find out what your peers are saying about ArcSight Analytics vs. IBM Security QRadar and other solutions. Updated: October 2024.
816,406 professionals have used our research since 2012.