IBM Security QRadar SIEM

Score8.4 out of 10

295 Reviews and Ratings

Contact

What is IBM Security QRadar SIEM?

IBM Security QRadar is security information and event management (SIEM) Software.

Categories & Use Cases

Media

Screenshot of QRadar SIEM Cloud native- Threat intelligence preview

Centralized event and log data collection
Effectiveness of real-time centralized event and log data collection
Category average: 8.9
Host and network-based intrusion detection
Ability to detect both endpoint intrusion and network ingress detection
Category average: 8.3
Event and log normalization/management
Ability to normalize event syntax so that logs can be compared and are machine-understandable
Category average: 8.8

Response orchestration and automation
Quality of built-in response orchestration and automation in Next-Gen SIEM
Category average: 8.4
Behavioral analytics and baselining
How effectively activity and behavior baselines are established and maintained
Category average: 8.6
Custom dashboards and workspaces
dashboards that can be customized to meet the needs of specific groups
Category average: 8.7

Most Frequent Users

Top 3 industries using IBM Security QRadar SIEM.

Based on HG Insights installation data

View all Reviews

#1 most frequent

Professional, Scientific, and Technical Services

24.7%

1,003 installations of 4,062

#2 most frequent

Finance and Insurance

10.8%

438 installations of 4,062

#3 most frequent

Information

10.0%

406 installations of 4,062

Verified User

Administrator in Information Technology (10,001+ employees)

Use Cases and Deployment Scope

With the increasing number of cybersecurity threats, our company needed software to help us correlate logs sent from our infrastructure for the purpose of detecting and preventing threats. We chose the IBM Security QRadar SIEM solution as it is the best solution on the market. We send all application and operating system logs from our machines to IBM Security QRadar SIEM, IBM Security QRadar SIEM analyzes them and correlates them to see if there are, for example, incorrect login attempts or other issues. Obviously, the software has to be managed by a team of people to function at its best. But once it's set up properly, you can set alerts that go off in certain situations to alert you via e-mail of problems that are occurring at that time. Really a very good SIEM!

Pros

Log correlation to find possible problems
Creation and visualization of custom dashboards
Handles almost any kind of log source
User management

Cons

High initial learning curve
High product costs for small businesses
Managing the product requires a high number of people working on it

Return on Investment

Reduced human work in data correlation
Saving time and energy in finding anomalies or cyber attacks
Dashboards provide a quick overview of cyber attacks

Alternatives Considered

Splunk Enterprise Security (ES) and ManageEngine Log360

Other Software Used

ManageEngine Endpoint Central, Kibana, MobaXTerm

Usability

Saulo Prado View profile

/security Specialist in Information Technology at BANCO DO BRASIL S/A (10,001+ employees)

Use Cases and Deployment Scope

I use the IBM QRadar SIEM since 2014 and I have had a good experience since then. We have a large number of security assets and QRadar SIEM helps us collect and correlate alerts, events, flows and incidents from multiple vendors. I am part of a SOC team at a financial institution with more than 90k employees, thousands of security devices, thousands of endpoints and without the help of QRadar SIEM it would be impossible to analyze threats, attacks and exploitations.

Pros

correlation events
search events timing
friendly managed rules
capability integration vendors
service support

Cons

Improvement in the process of consuming virtual machine resources
improvement in the process of analyzing errors and warnings generated by the system

Return on Investment

reduction in incident response time
Visibility of normalized data, reducing manual work time for parsing
Reduction in the security risk of the environment as a whole

Alternatives Considered

Microsoft Sentinel

Other Software Used

Trellix Endpoint Detection and Response (EDR), Microsoft Sentinel, F5 Big-IP Advanced Web Application Firewall

Marcos Vinícius Cunha View profile

Information Security in Information Technology at Paraná Banco (501-1000 employees)

Use Cases and Deployment Scope

We monitor the organization's various assets (firewall, EDR, WAF, cloud) to maintain a safe and integral environment. The tool correlates events from various existing sources to find anomalies and, if an offense is found, respond to that incident.

Pros

Rules based on market framework.
User Analytics.
Threat Intelligence.

Cons

Better executive indicators.
Classification of offenses.

Return on Investment

Better alerts.
Better event analysis.

Alternatives Considered

IBM Security QRadar SIEM and IBM Security QRadar SOAR

Other Software Used

IBM Security QRadar SOAR

Umair Javed View profile

soc in Legal at MCB Islamic Bank (51-200 employees)

Use Cases and Deployment Scope

In our organization we use Qradar for network monitoring been in the SOC Team We monitor logs evets and offences triggered. investigate them take action if required and closed them.
as we have integrated most of our sensitive servers in SIEM so it would help to monitor the activity going on these serves.

Pros

payload done great job to understand the events
the extension integrated in SIEM helps alot
offence investigation in siem much easier

Cons

things where i am facing issue is regex langue.
making rules and under standing logic also a difficult task
integration of any log source need to done in much easier way

Return on Investment

the good thing of qradar is it easy to understandable
bad thing is that if your stuck while doing some thing you will not get to the point answer
improvement required regarding the support team.

Alternatives Considered

Trend Micro Vision One

Other Software Used

Trend Micro Vision One, Splunk Application Performance Monitoring (APM), Trend Micro Apex One

Brandon Lowry View profile

Cyber Security Specialist in Information Technology at Beyond Finance (201-500 employees)

Use Cases and Deployment Scope

IBM Security QRadar SIEM is a comprehensive, robust and effective platform that plays a critical role in our financial services organization to address cyber security challenges. This platform provides accurate and prioritized alerts that ensure a high level of cyber security, I have witnessed how this platform has enhanced our ability to quickly detect and respond to threats in real time, leading to greater protection of our critical assets and data.

Pros

Enables identification and prioritization of vulnerabilities in IT infrastructure for corrective action.
Facilitates security incident investigation and forensic analysis.
Provides a real-time view of security events, enabling immediate incident response.
Can integrate with external threat intelligence sources to enrich data and improve threat detection.
Enables the generation of detailed and customized reports.

Cons

It can be complex to use at first, requiring time and training to take full advantage of its capabilities.
Implementation requires significant hardware infrastructure and resources, which can be costly for some organizations.

Return on Investment

Reduced incident response time, minimizing impact and costs.
Improved visibility into the organization's security posture.
Long-term cost savings by preventing security breaches.

Alternatives Considered

FortiSIEM

LogRhythm NextGen SIEM Platform

Splunk Enterprise Security

Microsoft Sentinel

IBM Security QRadar SIEM

What is IBM Security QRadar SIEM?

Categories & Use Cases

Media