ExtraHop Performance Platform vs. IBM Security QRadar SIEM

One very big use is the ability to resolve performance issues. One example used was with the performance of sql issues. ExtraHop [Performance Platform] gave us the packet tracing ability to see the database was being queried incorrectly. A programmer has written a query that would bring the database information local and one the queries instead of allowing the sql server itself to do the work and push out the information.

Incentivized

I would only recommend IBM Security QRadar SIEM in a few situations. For one, it's very easy to setup and use if all your log sources are generic from known vendors. It's also significantly cheaper than Splunk, which is nice if you're trying to save money or be more efficient. I would not recommend IBM Security QRadar SIEM for environments with a lot of custom logs and complicated detection requirements.

Incentivized

• It is very good at making it easy to find root cause for app issues.
• It provides very good stats, graphs, and diagrams of IT utilization.

Incentivized

• Enables identification and prioritization of vulnerabilities in IT infrastructure for corrective action.
• Facilitates security incident investigation and forensic analysis.
• Provides a real-time view of security events, enabling immediate incident response.
• Can integrate with external threat intelligence sources to enrich data and improve threat detection.
• Enables the generation of detailed and customized reports.

Incentivized

• Some person like me who want to see Extrahop can integrate better with other network analysis tools like Wireshark or TCPdump. The desired functionality I've been looking for is to program a kind of specific criteria to trigger the probe starts to run Wireshark or TCPdump to save the trace of a specific problematic session. Sometimes I want to see the evidence in a packet trace layer rather than just have the warning or error only presented in the dashboard.

Incentivized

• Need to spend more time configuring the system to properly interpret and normalize different type of data collected from multiple resources.
• While Rule creation QRadar uses that rules to detect security threats and generate alerts, but to creating and managing rules is bit complex & tedious work to complete.
• IBM Security QRadar SIEM is excellent in handling large & complex systems that requires in-depth knowledge and extensive training to configure and maintain the system which includes upgrading, optimization of performance & issue troubleshooting.

Incentivized

QRadar is an established and stable product, we have been using it for many years and want to continue to focus on it. Anyone who has used the product and knows it knows how reliable it is and how it facilitates continuous monitoring of threats from outside and inside. it is an exceptional product that is very useful for us.

Incentivized

As a grade I give 8 as QRadar is not easy to learn. It requires some time to master it. It also needs a team of people actively working on the product. Once you learn to use it the software works very well and it is easy to correlate and understand detected threats. It only takes time to learn how to use it well and configure it properly.

Incentivized

Documentation could be a lot better. Tech support is outstanding.

Incentivized

Customer support is Good of IBM, While Using IBM QRadar its deployment is to slow and suddenly stop working and crashed we have contacted IBM Support and Rised a Ticket within a few minute we get call back from customer support and Query Resolved by them Fast And Rapid Support of Ibm

Incentivized

The training was very useful and the people who taught us were very knowledgeable. Although the software may initially seem difficult to learn they made things much easier for us.

Incentivized

The training was very useful and the people who taught us were very knowledgeable. Although the software may initially seem difficult to learn they made things much easier for us.

Incentivized

Initial patience is required to learn how to use the product, and it takes a dedicated team to use it. One person is not enough, and it's not enough to just set it up and check it once in a while. It has to be used daily and kept under control to be used effectively

Incentivized

We use ExtraHop specifically to monitor network traffic. It does many other things very well also, but it is the best network traffic analysis tool that we currently have in house. The fact that it is agentless also makes it more reliable and not dependent on agents running on devices throughout our enterprise.

Incentivized

IBM Qradar takes the best from its competitors. Reliable and stable but sometimes very expensive, the SIEM from IBM offers a wide range of scenarios in which the customers can suite and size their own infrastructures. IBM Qradar doesn't really needs to stack up againt its competitors because it already sets an example in the SIEM world.

Incentivized

• Accelerated root cause analysis
• Cut out time passing the hot potato, focused time on resolution
• It's a good tool for change management, helping to transform a reactive culture to one that is more proactive
• Enables early warning and visibility, prompts action before a system goes down

Incentivized

• Offense investigation was really helped in tackling the incidents. It was accurate and brief
• The automation with IBM resilient (SOAR) was a milestone in elimination of user mistakes
• The X-Force threat intelligence supported us in getting the work done without any 3rd party enterprise OSINT database

Incentivized