IBM Security QRadar SOAR vs. Proofpoint Threat Response Auto-Pull

IBM Security QRadar SOAR is versatile. All the major players in SOAR field require the administrator to have coding experience but with IBM it is different. IBM's solution is a full-fledged automation solution, and not some threat-based or limited one. Meaning whatever comes to your mind, if you can write the code, you can do it. This goes from daily tasks from SOC to daily tasks of your network or security administrator or any other administrator. You can manage your ITSM solution if you want to, IBM is a playground and there is much to discover in its capabilities. If you do not have the knowledge or if you want a SOC/Threat Based SOAR solution, meaning you want automation but you want it to be limited to an area and out-of-box, you may choose other alternatives.

Incentivized

If your email admins spend time manually pulling malicious emails, this tool will save them countless hours of work and will do it for them 24 x 7. So if a user receives a malicious email after-hours, TRAP will auto pull it from the affected user's mailbox and potentially save you from an IT disaster.

Incentivized

• QRadar's ability to collect, analyze and normalize vast amount of security data from various sources is remarkable.
• QRadar allows us to define and automate incident response playbooks which have been amazing for streamlining the response to security incidents.
• It offers and extensive library of pre-built connectors and support for common security standards facilitating seamless integration with a wide range of security tools.

Incentivized

• Auto pull works great, even with our hybrid situation with 2 on premise exchange organizations.
• Reporting is good, nice graphs of all the actions.

Incentivized

• You still have to generate reports manually. Reports are very limited and practically not useful.
• The solution should not be SOAR class. Automations usually don't work. It's apparent that it's not designed for that.
• Lack of flexibility.
• Practically no support. The reported integration problems have not been resolved.

Incentivized

• Learning curve is steep.
• Interface can be clunky.
• Some interface items seem counter-intuitive.

Incentivized

It is beneficial to have a program that can run independently and be used without the supervision of a devoted employee

Incentivized

It is very easy to navigate and run the parts that we have needed

Incentivized

It's easy to use and requires very little administrator hands on.

Incentivized

I have never had to contact support

Incentivized

They are quick to respond and have talented support personnel.

Incentivized

Overall, IBM Security QRadar SOAR offered the same set of functionality that was needed by the organization as offered by Splunk SOAR, but the former is less expensive and solves all the purpose within budget. In addition, integration with other IBM products was easier and made implementation of a SOAR solution much faster.

Incentivized

I have never evaluated TRAP against another product.

Incentivized

• It provides comprehensive MTTD and MTTR metrics and we are aware of how secure our systems are at any given moment.
• We use linux 7.7, therefore the integrations are smooth.
• We've been able run our online shops securely for so long.

Incentivized

• Chances of phishing attacks has decreased.
• Your employees don't have to do anything, so no impact on productivity.

Incentivized