IBM Security QRadar SIEM vs. Zabbix

I would only recommend IBM Security QRadar SIEM in a few situations. For one, it's very easy to setup and use if all your log sources are generic from known vendors. It's also significantly cheaper than Splunk, which is nice if you're trying to save money or be more efficient. I would not recommend IBM Security QRadar SIEM for environments with a lot of custom logs and complicated detection requirements.

Incentivized

Zabbix is great for monitoring your servers and seeing alerts when the system uses too much CPU or memory. This allowed the system Engineer to be proactive and add resources to these systems to avoid interrupting the services. Especially servers running operations applications and services. This is one of the best usages for Zabbix.

Incentivized

• Enables identification and prioritization of vulnerabilities in IT infrastructure for corrective action.
• Facilitates security incident investigation and forensic analysis.
• Provides a real-time view of security events, enabling immediate incident response.
• Can integrate with external threat intelligence sources to enrich data and improve threat detection.
• Enables the generation of detailed and customized reports.

Incentivized

• Collecting hardware data - CPU, Memory, Network, and Disk Metrics are collected and reported on.
• Flexible design - It is very easy to build out even very large environments via the templating system. You can also start where you are - network monitoring, server monitoring, etc. and then build it out from there as time and resources permit.
• Provides a "plugin architecture" (via XML templates) to allow end users to extend it to monitor all kinds of equipment, software, or other metrics that are not already added into the software already.
• Very complete documentation. Almost every aspect of Zabbix has been documented and reported on.
• Cost - Zabbix is FOSS software and always free. Support is reasonably priced and readily available.

Incentivized

• Need to spend more time configuring the system to properly interpret and normalize different type of data collected from multiple resources.
• While Rule creation QRadar uses that rules to detect security threats and generate alerts, but to creating and managing rules is bit complex & tedious work to complete.
• IBM Security QRadar SIEM is excellent in handling large & complex systems that requires in-depth knowledge and extensive training to configure and maintain the system which includes upgrading, optimization of performance & issue troubleshooting.

Incentivized

• Creating an alert & its trigger can be made easier.
• More VM-based data collection counters should be introduced to have better VM monitoring.
• The raw counters collection agent in every node is relatively weak. It goes down often, which needs more stability.

Incentivized

QRadar is an established and stable product, we have been using it for many years and want to continue to focus on it. Anyone who has used the product and knows it knows how reliable it is and how it facilitates continuous monitoring of threats from outside and inside. it is an exceptional product that is very useful for us.

Incentivized

It is free. It didn't cost anything to implement (other than my time and the cost incurred for it) and it is filling a badly needed gap in our IT infrastructure. Support is available if we have issues and can be done annually or paid for on a per incident basis as needed. Expansion, updates, and all other future lifecycle activities are likewise free of cost, so as long as someone is able to implement/maintain the software (and the OSS project is maintained) then I imagine the company will never leave it.

Incentivized

As a grade I give 8 as QRadar is not easy to learn. It requires some time to master it. It also needs a team of people actively working on the product. Once you learn to use it the software works very well and it is easy to correlate and understand detected threats. It only takes time to learn how to use it well and configure it properly.

Incentivized

I think every organization, especially the IT department, needs a tool like this. I know of another product like Zabbix that gives a similar or the same solution, but its range makes it very useful. You can see almost all the device info in one place: disk usage, disk space, network usage, etc.

Incentivized

Customer support is Good of IBM, While Using IBM QRadar its deployment is to slow and suddenly stop working and crashed we have contacted IBM Support and Rised a Ticket within a few minute we get call back from customer support and Query Resolved by them Fast And Rapid Support of Ibm

Incentivized

The setup is the most time-consuming portion of using zabbix. It takes a lot of effort to shape it into a usable format and even then it can get very messy. It's not exactly intuitive and as mentioned the UI seems a bit antiquated. If I was to roll out a monitoring solution from scratch, I'd probably look for alternatives which are easier to use and maintain.

Incentivized

The training was very useful and the people who taught us were very knowledgeable. Although the software may initially seem difficult to learn they made things much easier for us.

Incentivized

The training was very useful and the people who taught us were very knowledgeable. Although the software may initially seem difficult to learn they made things much easier for us.

Incentivized

Initial patience is required to learn how to use the product, and it takes a dedicated team to use it. One person is not enough, and it's not enough to just set it up and check it once in a while. It has to be used daily and kept under control to be used effectively

Incentivized

We are a mainly Windows environment, so it would be useful if we could have used Active Directory to deploy agents. As of version 4.2, Zabbix has announced a new agent MSI file to allow exactly that. Unfortunately, we didn't have that option. Also, for Linux and MAC deployments, there is no simple way to deploy that. Using remote scripts you may be able to create something, but most places will opt for either SNMP (agentless) or manual installation of agents to add to Zabbix. A way of deploying agents via discovery would go a long way to helping in the adoption of the tool.

Incentivized

IBM Qradar takes the best from its competitors. Reliable and stable but sometimes very expensive, the SIEM from IBM offers a wide range of scenarios in which the customers can suite and size their own infrastructures. IBM Qradar doesn't really needs to stack up againt its competitors because it already sets an example in the SIEM world.

Incentivized

We're using the Solarwinds suite as our global monitoring standard, but it is very complex and its licensing model makes it difficult to monitor a wide range of technologies. So, we're using Zabbix as a complement on our monitoring process. Zabbix is a way more flexible and has free integrations to a wide range of technologies. It is also more 'user friendly' and easy to manage.

Incentivized

• Offense investigation was really helped in tackling the incidents. It was accurate and brief
• The automation with IBM resilient (SOAR) was a milestone in elimination of user mistakes
• The X-Force threat intelligence supported us in getting the work done without any 3rd party enterprise OSINT database

Incentivized

• Good ROI when trying to get ahead of network related problems instead of waiting for users to complain
• Good ROI when doing upgrades or exploratory work on a neglected network
• Good ROI when showing usage trends to management showing higher actual usage versus what was thought to be happening