Try our new research platform with insights from 80,000+ expert users

ArcSight Analytics vs IBM Security QRadar comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

ArcSight Analytics
Ranking in User Entity Behavior Analytics (UEBA)
14th
Average Rating
7.0
Number of Reviews
15
Ranking in other categories
No ranking in other categories
IBM Security QRadar
Ranking in User Entity Behavior Analytics (UEBA)
1st
Average Rating
8.0
Number of Reviews
204
Ranking in other categories
Log Management (6th), Security Information and Event Management (SIEM) (4th), Endpoint Detection and Response (EDR) (18th), Security Orchestration Automation and Response (SOAR) (4th), Managed Detection and Response (MDR) (10th), Extended Detection and Response (XDR) (14th)
 

Mindshare comparison

As of November 2024, in the User Entity Behavior Analytics (UEBA) category, the mindshare of ArcSight Analytics is 1.5%, up from 1.4% compared to the previous year. The mindshare of IBM Security QRadar is 13.8%, down from 18.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
User Entity Behavior Analytics (UEBA)
 

Q&A Highlights

Navin Rehnius - PeerSpot reviewer
Aug 10, 2021
 

Featured Reviews

Syed Ubaid Ali Jafri - PeerSpot reviewer
Aug 28, 2018
It has improved our system and network policy monitoring
I have used ArcSight Analytics to assess environments with more than a 100 network devices and 12 different firewalls.  I have used it to evaluate 120 servers, which include Sybase, AIX, SAP, Windows, other Linux-based servers.  It has been used with Db2 and Oracle databases ArcSight Analytics…
Muzzamil Hussain - PeerSpot reviewer
Aug 1, 2024
Is easy to integrate and doesn't require maintenance
One major drawback we are facing is in the area of IBM Security QRadar integration with flat file databases. IBM Security QRadar does not support flat file database integration. We are currently facing an issue with respect to the database, which you normally call a NoSQL database. There is no direct integration mechanism available with IBM Security QRadar. We have to approach IBM and generate a ticket so that they can develop a custom method for the integration. In database integration, we are facing issues with IBM Security QRadar. The solution does not support the integration of flat file databases. Certain organizations have flat file databases. IBM does not support direct integration with some databases. We had to create a plug, and we requested IBM to develop a parser, but it is taking IBM a couple of months to develop it. I think a flat-file database should be supported directly instead of developing a parser plugin. There should be a more refined threat intelligence platform, and cross-integration should be possible with locally available threat intelligence platforms.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"This solution makes it easy to create use cases, and it is easy to move queries from use cases to the report to the dashboard."
"ArcSight Analytics has improved our system and network policy monitoring."
"This solution allows us to identify connections for all users."
"The ability to correlate different logs is the solution's most valuable feature."
"The data collection and the integration with different products are valuable features."
"The features I have found most valuable are it capabilities for behavioral analytics and anomaly detection."
"The two most valuable features of this solution are its stability and scalability."
"One of the most valuable features is the alerts."
"The ability to transition from microscopic to macroscopic view, instantly, is very good."
"It also has a graph that shows the traffic history. I can see what happened yesterday or today. If there's an incident, I can check the traffic behavior on QRadar."
"It is incredibly easy to deploy. All the appliances are flexible in the roles that they serve and are all managed the in the same way."
"Integration is very easy and the reporting is good."
"No doubt about it, the solution is extremely stable."
"Network-Based Anomaly Detection (NBAD): Using NetFlow, JFlow, SFlow, or QFlow (all 7 layers), offenses are detected as a response when a rule is triggered."
"This solution provides me with various alarms, and I have found security issues with some of my other products."
"There are more than 120 extensions in QRadar, which are easy to install and configure. These can improve your analysis of events."
 

Cons

"ArcSight's features that can be improved include anything related to its visualization capabilities and user friendliness."
"It's a difficult product to navigate, it's complex."
"I faced stability issues with Windows Operating System. The installed connectors hang if they remain idle for a long period of time."
"The customer service could be improved, and additional integrations with other APIs could be added."
"I would like to see integration with automation products, such as Phantom Automation."
"[There is] complexity in maintaining it and managing it. It's not easy to use. It requires a lot of training."
"The reporting and the way it is worded needs to be improved in future releases. The dashboards are quite poorly designed."
"I would like to see orchestration."
"Technical support is good, but not great."
"The solution is expensive compared to other products."
"The tool is very complicated. One place for improvement would be to have a more user-friendly interface. Having better support in Spanish would be cool."
"There should be an extension where we can get the reports. This could be an extension to the dashboard with the Guardian or another product with limited technology, for example IPS. Now, we only have IBM. Basically, it needs more and more integration models."
"Dashboards and reports could provide better visualization of SIEM activity."
"The initial setup requires that you have somebody with the proper skill set, and it would help if the configuration were easier."
"If you have too many events that occur, then the storage capacity becomes a problem. You need to have more storage."
"The AQL queries could be better."
 

Pricing and Cost Advice

"My customers pay a yearly licensing fee for ArcSight Analytics."
"The monthly licensing fee is around $20,000. There aren't any costs in addition to the standard licensing fee."
"In addition to the costs of standard licensing fees, there is the cost of labor for maintenance."
"It can range between $30,000 and $40,000 USD, and can go up to $500,000 and $600,000 USD."
"ArcSight Analytics is a bit expensive compared with other tools in terms of licensing costs, training, hardware implementation, and support."
"This solution is expensive."
"There are different types of subscriptions available. We were on an annual subscription, but our customers typically choose the two years subscription option."
"It's too expensive."
"I think that the price is fair, but we can always say that the price could be cheaper."
"It's not expensive for the resources that it gives you."
"The price of this solution is a little high."
"The product is expensive. We have purchased the perpetual license, but we pay for the support."
"QRadar is quite expensive. It wouldn't be worth it for a small business..."
"The solution comes with a high price tag, while some of the competitors provide identical functionality in their offerings at no extra cost."
report
Use our free recommendation engine to learn which User Entity Behavior Analytics (UEBA) solutions are best for your needs.
814,649 professionals have used our research since 2012.
 

Comparison Review

VS
Jun 28, 2015
Qradar vs. ArcSight
Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…
 

Answers from the Community

Navin Rehnius - PeerSpot reviewer
Aug 10, 2021
Aug 10, 2021
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, remember that any EDR/XDR should integrate to the SIEM/SOAR and a strong threat intel source. If you consider SOC outsourcing take your time and find one you can integrate like a virtual team member. They a...
2 out of 12 answers
KM
Jul 26, 2021
I haven't used these big-name ones like Splunk etc. but I feel they're overpriced. I think they charge an arm and a leg for each module. The ROI justification is not there. Why not try a cheaper and robust alternative like Elasticsearch?
KA
Jul 26, 2021
We are using LogRthythm SIEM complete case management and offer SIEM/SOC as service.
 

Top Industries

By visitors reading reviews
No data available
Educational Organization
22%
Computer Software Company
14%
Financial Services Firm
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What do you like most about ArcSight Analytics?
ArcSight Analytics is used to get a deeper insight and threat analysis about the network.
What is your experience regarding pricing and costs for ArcSight Analytics?
My customers pay a yearly licensing fee for ArcSight Analytics.
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendlier GUI and are not licensed based on capacity (amount of logs and information in...
What do you like most about IBM QRadar?
The event collector, flow collector, PCAP and SOAR are valuable.
 

Also Known As

ArcSight User Behavior Analytics, ArcSight UBA
IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar, IBM QRadar User Behavior Analytics, IBM QRadar Advisor with Watson
 

Learn More

 

Overview

 

Sample Customers

Information Not Available
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.
Find out what your peers are saying about ArcSight Analytics vs. IBM Security QRadar and other solutions. Updated: October 2024.
814,649 professionals have used our research since 2012.