Item: IBM Security QRadar EDR
Rating: 8
Author: Verified User

Use Cases and Deployment Scope

We use it to detect anomaly activity in the user computer or server, and respond as fast as possible if detected any possibilityt of being a true malicious activity.

Pros and Cons

Pin processes in the tree investigation
Lua script
friendly UI/UX

use AI to review previous false negatives that contributed wrongly in the AI suggestion on the follow alerts
easily run a script based on values from an hash, ips, path inside the boxes on the behavioral tree
apply the remediation to a range of endpoint instead to only the endpoint of the current alert
use ajax for example to update the alert page automatically while actions are happening
for api have profiles that allow only get actions, or just post on some actions
create users in bulk

Return on Investment

The Ai helps a lot on saving hours and the behavioral tree

Easy Tasks

Analyze the behavioral tree and what happened

Automation

It helps saving hours sicne it is based on the previous case resolutions.

Alternatives Considered

CrowdStrike Falcon and FortiXDR

It is preatty easy of working on IBM QRadar EDR.

Key Insights

Do you think IBM Security QRadar EDR delivers good value for the price?

Not sure

Are you happy with IBM Security QRadar EDR's feature set?

Yes

Did IBM Security QRadar EDR live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of IBM Security QRadar EDR go as expected?

Yes

Would you buy IBM Security QRadar EDR again?

Yes

Other Software Used

IBM Security QRadar SIEM, Fortinet FortiGate, DFLabs IncMan

Likelihood to Recommend

It is well suited for companies that already have part of IBM QRadar Suite, an less appropriate for those that have multiple vendors integrations get little more harder of achieve but possible.

IBM QRadar EDR Review

Overall Satisfaction with IBM Security QRadar EDR