Try our new research platform with insights from 80,000+ expert users

ArcSight Analytics vs IBM Security QRadar comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 6, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

ArcSight Analytics
Ranking in User Entity Behavior Analytics (UEBA)
13th
Average Rating
7.0
Reviews Sentiment
6.7
Number of Reviews
15
Ranking in other categories
No ranking in other categories
IBM Security QRadar
Ranking in User Entity Behavior Analytics (UEBA)
1st
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
208
Ranking in other categories
Log Management (6th), Security Information and Event Management (SIEM) (4th), Endpoint Detection and Response (EDR) (17th), Security Orchestration Automation and Response (SOAR) (4th), Managed Detection and Response (MDR) (9th), Extended Detection and Response (XDR) (11th)
 

Mindshare comparison

As of April 2025, in the User Entity Behavior Analytics (UEBA) category, the mindshare of ArcSight Analytics is 1.2%, down from 1.6% compared to the previous year. The mindshare of IBM Security QRadar is 11.9%, down from 17.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
User Entity Behavior Analytics (UEBA)
 

Q&A Highlights

Navin Rehnius - PeerSpot reviewer
Aug 10, 2021
 

Featured Reviews

Syed Ubaid Ali Jafri - PeerSpot reviewer
It has improved our system and network policy monitoring
They should improve on the following: * Timely resolution of issues and proper support once a ticket has been generated. * Systems appearing on the network which are not part of the domain controller. These should be monitored. * Inactive connections from servers, which are upgraded or downgraded within a VM, should be automatically revoked. * Logger monitoring should be separated from ESM monitoring. * Ability to integrate with cloud-based applications and monitor cloud-based events. * Ability to log and notify tailored rules via SMS/email. * Provide more ArcSight training and workshops.
Md. Shahriar Hussain - PeerSpot reviewer
Real-time incident detection and user-friendly dashboard benefit daily operations
There are many types of AI, and this AI is very limited in SQL and features. There may be potential for improvement. So far, it seems very limited. It shows some good features in the correlation part, but I think there is room for improvement. For instance, when creating rules, it can suggest more rules, reducing the effort needed. If AI-related support can suggest rules and integrate with existing security devices like MD, IPS, this SIM can create more relevant rules. Sometimes logs I receive don't mean anything, and I need technical stakeholders to share or forward logs, but these are sometimes inadequate. Keywords can help identify insufficient logs. I often lack time to verify logs. Sharing false positive results could be reduced to help my team.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Allows multiple integrations with multiple systems in a stable and flexible fashion."
"This solution allows us to identify connections for all users."
"The features I have found most valuable are it capabilities for behavioral analytics and anomaly detection."
"The two most valuable features of this solution are its stability and scalability."
"ArcSight Analytics has improved our system and network policy monitoring."
"The data collection and the integration with different products are valuable features."
"ArcSight Analytics is used to get a deeper insight and threat analysis about the network."
"The correlation engine is good."
"The monitoring and dashboards are great."
"Provided that the report is prebuilt and I can find what I am looking for, the reporting is the most valuable feature in this solution."
"It has very rich functionality."
"The most valuable features would have to be the products' ability to customize vulnerability management settings."
"It does good correlation for events. It does good general analysis, and it has good apps as well."
"There are other third-party plugins that we can use."
"It comes with many rules disabled. You can tune them and modify them according to your enterprise needs and avoid false positives."
"QRadar has somewhat of a new structure recently from last gen. They have moved from the standard UI based infrastructure."
 

Cons

"The reporting and the way it is worded needs to be improved in future releases. The dashboards are quite poorly designed."
"Inactive connections from servers, which are upgraded or downgraded within a VM, should be automatically revoked."
"The interactive dashboard is complicated and you need to have training in order to use it, so I think that it could be made easier to use."
"It's a difficult product to navigate, it's complex."
"Network integration is very crucial, and you need to have the knowledge to get it done."
"Their support team could be better."
"ArcSight is not a user-friendly solution and the interface needs to be improved."
"The customer service could be improved, and additional integrations with other APIs could be added."
"I would like for them to develop a detection management solution. It does not have a detecting management solution in it, you have to buy it as it is, on top of the extended solution."
"The tech support is not that good."
"The implementation and configuration are not easy."
"The user interface is a bit difficult to get used to."
"Certain updates—especially when using Azure—don't apply directly. Our engineering team must invest additional effort to implement these updates. However, the tool's cloud-based version poses no issues. However, upgrading the product can sometimes be challenging for on-premises instances."
"Their technical support is not good. We opened a lot of cases and from my experience, they are not complicated issues but it takes forever to get an answer."
"I would like for Yara to be supported by all components."
"IMB should reduce the pricing, or reduce some of the features for a more economical solution for the customer."
 

Pricing and Cost Advice

"ArcSight Analytics is a bit expensive compared with other tools in terms of licensing costs, training, hardware implementation, and support."
"This solution is expensive."
"The monthly licensing fee is around $20,000. There aren't any costs in addition to the standard licensing fee."
"It can range between $30,000 and $40,000 USD, and can go up to $500,000 and $600,000 USD."
"My customers pay a yearly licensing fee for ArcSight Analytics."
"In addition to the costs of standard licensing fees, there is the cost of labor for maintenance."
"The price of this solution is a little high."
"Customers have to purchase a license based on the number of users, devices, and applications they want to protect. It allows you to take a license on a subscription basis for three years or five years."
"There is a license required for this solution and it is an annual payment. I have found all solutions in the category to be expensive, including Splunk."
"The solution comes with a high price tag, while some of the competitors provide identical functionality in their offerings at no extra cost."
"The tool's price is high."
"It's not expensive for the resources that it gives you."
"They can give us some scalability and flexibility on pricing. If its pricing can be reduced, it would help a lot of customers in bringing in a new SIEM environment and grow business in the market. If I start a license today and take around 10,000 EPS, and after a month, there is an increase in the number of clients on my platform, I can increase the number of licenses. I can add 5,000 EPS on a yearly basis."
"It's too expensive. The licensing is also a little bit difficult to understand because you have to license it per event and per number of flows."
report
Use our free recommendation engine to learn which User Entity Behavior Analytics (UEBA) solutions are best for your needs.
849,475 professionals have used our research since 2012.
 

Comparison Review

VS
Jun 28, 2015
Qradar vs. ArcSight
Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…
 

Answers from the Community

Navin Rehnius - PeerSpot reviewer
Aug 10, 2021
Aug 10, 2021
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, remember that any EDR/XDR should integrate to the SIEM/SOAR and a strong threat intel source. If you consider SOC outsourcing take your time and find one you can integrate like a virtual team member. They a...
2 out of 12 answers
KM
Jul 26, 2021
I haven't used these big-name ones like Splunk etc. but I feel they're overpriced. I think they charge an arm and a leg for each module. The ROI justification is not there. Why not try a cheaper and robust alternative like Elasticsearch?
KA
Jul 26, 2021
We are using LogRthythm SIEM complete case management and offer SIEM/SOC as service.
 

Top Industries

By visitors reading reviews
No data available
Educational Organization
24%
Computer Software Company
14%
Financial Services Firm
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What do you like most about ArcSight Analytics?
ArcSight Analytics is used to get a deeper insight and threat analysis about the network.
What is your experience regarding pricing and costs for ArcSight Analytics?
My customers pay a yearly licensing fee for ArcSight Analytics.
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendlier GUI and are not licensed based on capacity (amount of logs and information in...
What needs improvement with IBM Security QRadar?
The commercials can be looked into. The costing part could be improved.
 

Also Known As

ArcSight User Behavior Analytics, ArcSight UBA
IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, IBM QRadar Advisor with Watson
 

Overview

 

Sample Customers

Information Not Available
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.
Find out what your peers are saying about ArcSight Analytics vs. IBM Security QRadar and other solutions. Updated: April 2025.
849,475 professionals have used our research since 2012.