IBM Security QRadar Reviews

It helps us discover any threats with their alerts and tracking.

QNI is the most valuable feature. 

I would like for them to lower the price. 

The system is quite stable, so far we haven't had any problems. Although the initial supply of the appliance was a bit faulty, the processor kept on failing. We were within the warranty so they supplied new ones. After loading logs, the system is very stable and nothing to worry about.

It's very scalable. There are currently five users. We may still onboard more users depending on the requirements and their departmental level.

We do plan to increase usage. 

Their support is excellent, they are available when we need them. I'm satisfied so far.

The initial setup wasn't exactly straightforward but the vendor who set it up for was helpful. It was very straightforward with their help. The deployment took two months. 

We require two admins for maintenance. 

We used our own people and the certified IBM vendor for the implementation. We had a very good experience with them. 

We do licenses once a year. 

We also looked at LogRhythm.

I would advise someone considering this solution to write down your use cases and evaluate them with the vendor. Evaluate the best solution based on your use cases because you are the ones who are going to use it. The vendor will try and implement and leave you with your problems.

If the solution meets your requirements and solves most of your problems, you're good to go. QRadar is the best solution we have. The only challenge is that IBM has been a closed enterprise. It should be more open to integrating with other providers at an enterprise level. We're a bank and the core banking system integration is not always straightforward and there is no integration between IBM and these products. If IBM could open up and provide a way of integrating it seamlessly, without charging more for it, that would make a big difference. 

I would rate it an eight out of ten. 

It is under a non-disclosure agreement (NDA).

• It helps because you don't need an army to execute the project when you do the PoC, and when finally going to production. 

• The abundant out-of-the-box features which are operating wonderfully.
  

• It's easy to set up.
• There are a lot of great out-of-the-box features included.
• It's a state-of-the-art product for security information and event management (SIEM).

• Slow response sometimes and a not-so-helpful staff there. So make the support better, and you could succeed even more.
  
• The released patch quality is poor. IBM should test those patches on their side, not on the client's side. So, there are a lot of improvement to do. 
• I would appreciate if IBM could create another more intuitive, easier way (intuitive UI) to perform advanced searches rather that just counting on regular expressions.

The quality of technical support depends on the IBM support person. Sometimes, it's hard to get the right person on the other side. A ticket coordinator could be the key to better quality delivery.  

They are sometimes slow to respond and unhelpful.

I highly recommend this product.

This product helps to build a strong architecture, which is important to avoid problems.

I think the QDI is very good.

The biggest drawback of this solution is the price.

The threat detection needs improvement, they have many false positives.

It is important to have good architecture. If you have problems and you don't have a strong architecture you, will have trouble with this solution.

I have been using IBM QRadar for three years.

We are using version 7.4.3

It's a stable solution.

We have many interactions with L2 support when we needed L3 support. I would rate technical support an eight out of ten.

The initial setup is straightforward. We had no problems.

It took approximately a month to deploy.

This price is a little high, so it's an expensive product. It is a good solution but not a cheap one.

I would rate IBM QRadar a nine out of ten.

SIEM technology is the most valuable feature of this solution, as it can be integrated with almost every application and system. If not, then you may ask IBM to write a parser for it.

You have the visibility of different events, thus we can resolve the issue.

They should provide more integration with more devices.

I have been using this solution for three years.

I would give the technical support a 8/10 rating. They are excellent.

The setup was straightforward.

The pricing policy is good.

We looked at another solution, NitroSecurity Inc.

If you have a good budget, then go for IBM QRadar.

IBM QRadar is typically deployed in a SOC environment for security monitoring. It is used for log and packet capturing. It has some supporting technology, such as data leakage prevention and data encryption.

I have found visibility very helpful for analytics.

This solution is on-premise and many customers are moving to the cloud base solution.

I have been using this solution for approximately one year.

I have not had any complaints from my clients about the stability of the solution.

The solution is scalable. Our customers that are using this solution are mainly large-sized companies, such as the government.

The technical support is very good.

Nowadays cloud stack security is very good. Some of my customers are planning to build their data center over the cloud, or implement cloud-based services using some of the beneficial services, such as threat intelligence services.

I rate IBM QRadar a ten out of ten.

Our primary use case for this solution for the management of our security services, and our NOC (Network Operations Center) services.

In addition to using this solution for our security operations center, we are using it for our other customers.

It needs more resilience and functionality. 

My impressions of the stability is that it is good.

The scalability is good. Internally we have many customers, but we offer this as a specific consultancy service. I do not know with certainty the number of users for this product in our customer environment.

We used a consultant to assist us with the implementation of this solution.

Our licensing costs for this solution is on a yearly basis.

I would rate this product eight out of ten.

We have very large, distributed implementations. The best case that we get out of the solution is the rapid insight into security events and offenses in our environment.

The benefit of the solution is a combined view into all of our network events and flows from many log sources across our enterprise. This provides a single pane of glass in order to review what's going on in our environment.

I would like to see more APIs available in order to provide tighter integrations between other IBM products and third-party solutions. I would like to see new cognitive advisors, cognitive capabilities, and more integration capabilities.

I find it to be highly stable. It's one of those situations where you need to have high availability. We have a high availability implementation, so we never lose an environment.

Scalability has been very good. If you need to add to the environment at any given time, based on a merger or acquisition, a new office, or a new data center, you can simply forward events from those centers or add additional hardware. You can include it right into your implementation.

I would definitely recommend QRadar to anyone looking for an SIEM solution in their organization. This is especially the case for mid- to large-scale enterprise solutions, compared with the competitors.

The most valuable feature is user behavior analytics (UBA).

The EPS and FPS graphs are helpful.

The collecting of logs and processes is very good.

The support process needs to be improved.

Every SIEM solution has issues with plugins, as they have to connect to different log systems. It can affect security, infrastructure, and other things. IBM should continue to expand its database and cover as many systems as possible.

I have been using IBM QRadar for about one year.

QRadar is a very stable product.

The whole process for support is something that needs to be improved. You have to create a case, export the log and attach it to the case, then an engineer will clarify what you need to export and attach it to the ticket or support case, and so on. When you're working with a system that does not have good bandwidth, it makes it even more stressful. It is a lot of work and it should be easier to do.

My colleague has worked more with support and the feedback that I have heard is that they are quite good. It's the process that I am complaining about.

The initial setup is pretty straightforward.  We had several logs to integrate so it took a week and perhaps a few days.

I would rate this product a nine out of ten.