Amazon CloudWatch vs IBM QRadar

Likelihood to Recommend

Ideal for monitoring AWS services and workloads. We have several of our websites entirely hosted on AWS and we're able to get a Grafana dashboard of all the relevant metrics from CloudFront, S3, EC2, RDS, and Elastic Beanstalk. This can be set up within the hour or templated on your code for infrastructure (we do this with terraform & cloud formation). By design, it isn't suited for non-AWS workloads.

Read full review

Verified User

Professional in Finance and Accounting

Financial Services Company, 501-1000 employees

View all 34 answers on this topic

If you have a small-to-large company looking for a SIEM solution that "does the job" and is easy to deploy/use, QRadar is your tool. If you're looking for a complex solution that supports integration with data-mining solutions (e.g. ELK), then you may need a different solution. Overall, QRadar fits the needs of 99% of the companies. It is one of the easiest SIEM solutions to deploy and use.

Read full review

Verified User

Professional in Professional Services

Computer & Network Security Company, 11-50 employees

View all 20 answers on this topic

Feature Rating Comparison

Amazon CloudWatch

IBM QRadar

Centralized event and log data collection

Correlation

Event and log normalization

Deployment flexibility

Integration with Identity and Access Management Tools

Custom dashboards and views

Host and network-based intrusion detection

Pros

Managing log retention periods is very simple with CloudWatch, and can be configured on a per-group basis.
Monitoring host performance is very easy when coupled with the CloudWatch Agent on an EC2 instance. A simple installation and configuration replaces an entire 3rd-party host monitoring stack.
CloudWatch is flexible enough for not just host monitoring, but application monitoring as well. It's easy to pipe local logs up to CloudWatch and extract structured data in order to monitor and set alerts on custom app metrics.

Read full review

Brian Dentino

Founder

finbox.ioInternet, 1-10 employees

View all 34 answers on this topic

It allows us to have visibility to potential problems both on premise and in the cloud which was key as we have become a hybrid consumer.
It has automated monitoring which has allowed us to see threats faster and also allowed us to be proactive.
By having over 20,000 employees, QRadar has also allowed us to be aware of internal threats that are brought into the company by unsuspecting employees.

Read full review

Verified User

Director in Information Technology

Construction Company, 10,001+ employees

View all 20 answers on this topic

Cons

CloudWatch doesn't monitor things outside of the cloud, it's not what it is intended for.
Billing is confusing as it bills on Dashboard, metrics called, custom metrics, etc. Hard to forecast the charge.
Paradigm is confusing sometimes and difficult to learn.

Read full review

Verified User

C-Level Executive in Information Technology

Retail Company, 1001-5000 employees

View all 34 answers on this topic

There is a steep learning curve compared to other platforms. Qradar is incredibly powerful but does require some homework.
There is a glaring lack of threat feed utilization outside of STIXX/TAXII which remains very limited at this time.
May require a considerable amount of tuning during deployment with very little "out of the box" offense information.

Read full review

Verified User

Engineer in Information Technology

Automotive Company, 1001-5000 employees

View all 20 answers on this topic

Usability

Amazon CloudWatch 7.0

Based on 2 answers

The tool collects a great deal of data, and data that's not available many other places. But the data is hidden in obscure places, and the logs are hard to read and follow. The user interface could use a heavy rework, and several companies have made a business out of scraping the data and presenting it better.

Read full review

Verified User

Professional in Information Technology

Human Resources Company, 51-200 employees

View all 2 answers on this topic

No score

No answers yet

No answers on this topic

Support Rating

Amazon CloudWatch 7.6

Based on 16 answers

Support is effective, and we were able to get any problems that we couldn't get solved through community discussion forums solved for us by the AWS support team. For example, we were assisted in one instance where we were not sure about the best metrics to use in order to optimize an auto-scaling group on EC2. The support team was able to look at our metrics and give a useful recommendation on which metrics to use.

Read full review

Ramindu Deshapriya

Lead Consultant - Technology

VirtusaComputer Software, 10,001+ employees

View all 16 answers on this topic

IBM QRadar 8.5

Based on 4 answers

I've had many issues with QRadar, and the support would hear and respond to my question all the time (more so than in the case of IBM Resilient support). They were very quick to respond, were helpful, and provided remote access.

Read full review

larbi belmiloud

cyber security Analyste

intervalle technologiesComputer & Network Security, 11-50 employees

View all 4 answers on this topic

Alternatives Considered

I can only speak to how it's positively benefited my organization. The problem was that hosting in-house servers is no longer a cost-effective solution vs. containerization in the cloud. But once you rely on hosting servers in the cloud you need a tool to manage every aspect of that including log monitoring, resource utilization, and application performance. Amazon CloudWatch is exactly the tool you need.

Read full review

Verified User

Employee in Engineering

Information Services Company, 1001-5000 employees

View all 34 answers on this topic

Splunk Enterprise Security I've found is the easiest of all major SIEM's to deploy due to its event normalization capabilities. It lags behind QRadar in event correlation but is better in user GUI customization. One issue where QRadar beats it is in cost. Splunk starts off cheap, but as you expand (due to it's licensing model), it quickly becomes very expensive. It is the monster that keeps on feeding.

Read full review

Douglas Concepcion

Director of Security Solutions Engineering

Micro StrategiesInformation Technology and Services, 51-200 employees

View all 20 answers on this topic

Return on Investment

Scalability. Saving us cost when we can downgrade underperforming instances.
Great monitoring and peace of mine without always having to check logs to any services failure.
Support cost is high. It would be nicer if documentation would be easier to follow.

Read full review

Verified User

Engineer in Engineering

Computer Software Company, 51-200 employees

View all 34 answers on this topic

QRadar has helped us improve our rating when going through an IT audit.
It has allowed us to answer some security related contract questions much more positively when going through contract negotiation.
It helps us to protect our company and investors from Outside and Internal threats.

Read full review

Verified User

Director in Information Technology

Construction Company, 10,001+ employees

View all 20 answers on this topic

Pricing Details

General

Free Trial

Yes

Free/Freemium Version

Yes

Premium Consulting/Integration Services

Yes

Entry-level set up fee?

No

Amazon CloudWatch Editions & Modules

Edition

First 10,000 Metrics	$0.30¹
Next 240,000 Metrics	$0.10¹
Next 750,000 Metrics	$0.05¹
Over 1,000,000 Metrics	$0.02¹

Per Metric

Additional Pricing Details

With Amazon CloudWatch, there is no up-front commitment or minimum fee; you simply pay for what you use. You will be charged at the end of the month for your usage.

General

Free Trial

—

Free/Freemium Version

—

Premium Consulting/Integration Services

—

Entry-level set up fee?

No

IBM QRadar Editions & Modules

Edition

Cloud	$800.00¹

Per Month

Additional Pricing Details

—

Rating Summary

Amazon CloudWatch

IBM QRadar

Amazon CloudWatch

IBM QRadar

Amazon CloudWatch

IBM QRadar