IBM Security QRadar SIEM

With the increasing number of cybersecurity threats, our company needed software to help us correlate logs sent from our infrastructure for the purpose of detecting and preventing threats. We chose the IBM Security QRadar SIEM solution as it is the best solution on the market. We send all application and operating system logs from our machines to IBM Security QRadar SIEM, IBM Security QRadar SIEM analyzes them and correlates them to see if there are, for example, incorrect login attempts or other issues. Obviously, the software has to be managed by a team of people to function at its best. But once it's set up properly, you can set alerts that go off in certain situations to alert you via e-mail of problems that are occurring at that time. Really a very good SIEM!

• Reduced human work in data correlation
• Saving time and energy in finding anomalies or cyber attacks
• Dashboards provide a quick overview of cyber attacks

Splunk Enterprise Security (ES) and ManageEngine Log360

ManageEngine Endpoint Central, Kibana, MobaXTerm

I use the IBM QRadar SIEM since 2014 and I have had a good experience since then. We have a large number of security assets and QRadar SIEM helps us collect and correlate alerts, events, flows and incidents from multiple vendors. I am part of a SOC team at a financial institution with more than 90k employees, thousands of security devices, thousands of endpoints and without the help of QRadar SIEM it would be impossible to analyze threats, attacks and exploitations.

• reduction in incident response time
• Visibility of normalized data, reducing manual work time for parsing
• Reduction in the security risk of the environment as a whole

Microsoft Sentinel

Trellix Endpoint Detection and Response (EDR), Microsoft Sentinel, F5 Big-IP Advanced Web Application Firewall

We monitor the organization's various assets (firewall, EDR, WAF, cloud) to maintain a safe and integral environment. The tool correlates events from various existing sources to find anomalies and, if an offense is found, respond to that incident.

• Better alerts.
• Better event analysis.

IBM Security QRadar SIEM and IBM Security QRadar SOAR

IBM Security QRadar SOAR

IBM Security QRadar SIEM is user-friendly. It is not a burden to manage offensives because of excellent correlation and the ability to observe any earlier offense from the same attacker. IBM Security QRadar SIEM is versatile. This integrates popular solutions effortlessly. IBM Security QRadar SIEM takes on the management, correlation, and investigation of network and application events. Any harm can be mended without letting go of the profit with this technology. Everything about the network activity is visualized in IBM Security QRadar SIEM.

• Automated threat response and integration with other security solutions.
• Easy configuration of log sources.
• Quick customer service.
• Simple installation and upgrade process.

Miro, Adobe Marketo Engage, LogicMonitor

We use IBM Security QRadar SIEM as a SIEM in a few of our internal customer environments. This helps us provide security monitoring to those environments once we onboard the relevant logs. In each environment we onboard 20+ different hosts and log types and write detections for threat cases that we've identified.

• Money saved compared to other SIEMs
• Reduced manual work on onboarding generic log sources
• Easy integration with other tools

Splunk Enterprise Security (ES) and Splunk Enterprise

Splunk Enterprise Security (ES), ExtraHop Reveal(x)