We can integrate events, flows, and vulnerability data, correlate information from different security controls, create our own rules and building blocks, and automate responses. It also offers a solid range of built-in DSMs, so integrating standard technologies is relatively straightforward, while custom log sources can still be handled when needed.

The UI is mature, and the team is working hard to modernize it. QRadar also requires proper sizing, tuning, and engineering to achieve the best performance and ROI. Overall, I see it as a mature enterprise SIEM that gives a SOC team a lot of control over detection, investigation, and response. Review collected by and hosted on G2.com.

The current licensing is mainly based on EPS. It would be beneficial to also offer a log-volume-based licensing model or greater flexibility.

For each device type, QRadar should also provide a ready-made content pack containing recommended use cases, key fields, event IDs, rules, and building blocks. Review collected by and hosted on G2.com.

I liked it's ability to integrate with other systems and the ability to do netflow and the reportinmg capabilties Review collected by and hosted on G2.com.

I disliked that the decision was made to stop developing it and sell it off, essentially just to let it fade away. Review collected by and hosted on G2.com.

QRADAR is easy to integrate, data in terms of logs and alerts are collected and perse in a reportable way. Review collected by and hosted on G2.com.

Components license, renewal costs and high Review collected by and hosted on G2.com.

Easy to search between events of your log sources Review collected by and hosted on G2.com.

The solution hasn’t really evolved. It’s a solid option if you’re looking for a legacy SIEM, but it lacks many of the features you’d expect from newer SIEM platforms. Review collected by and hosted on G2.com.

strong correlation, mature security monitoring, compliance reporting, and support for complex environments including cloud, on-premises Review collected by and hosted on G2.com.

Enterprise licensing and infrastructure costs can be significant for large-scale deployments. Review collected by and hosted on G2.com.

Dashboard is very good and offense writing is easy compare to other SIEM products and ease of use when checked with other products Review collected by and hosted on G2.com.

Nothing much but UI can be modifies a little bit more Review collected by and hosted on G2.com.

The scalability of the platform allows seamless integration with different products, enabling efficient correlation of events from different log sources. Review collected by and hosted on G2.com.

Initial implementation and customisation can be challenging and require significant time and expertise to adapt the system to the specific needs of the organisation. Review collected by and hosted on G2.com.

One of QRadar's strengths is certainly the intuitive user interface, which can help less experienced users move more easily within SIEM pages. One other good thing is the scalability and easy integration with most of the products on the market, which is critical for correlating events from different log source types. Review collected by and hosted on G2.com.

The main problem encountered in 5 years of product is the technical support received from IBM in case of major problems. Working in cyber security, I believe that response times are a fundamental point, in a world where even a few minutes can make the difference. Review collected by and hosted on G2.com.

- AQL language have the same syntax as SQL, making it easy and fast to create fine grained searches;

- AQL also makes it easy to create Dashboards, really helpful to our clients;

- Rule creation is easy enough to understand and implement;

- Integration with IBM X-Force is fundamental to our operation;

- New UI's visual builder makes it super easy to search for events and flows;

- Easy to setup multiple domains for everyday use in multiple environments;

- IBM's employees provide great support; Review collected by and hosted on G2.com.

- New UI (QRadar UI (v2.32.0)) have less features than the old one, we can't search for offenses as easily: we can't search for offenses that started in an specific date, only predefined timeranges (hour, 12h, 7d, 30d etc);

- Pulse only allows to edit a dashboard if you're the one who created it. All admins should be allowed to edit them;

- We can't create notes on an offense from the new UI, notes are really helpful;

- Report building is terrible, clumsy and slow, and not a lot of customization; Review collected by and hosted on G2.com.

The features like advanced threat detection, user friendly UI, scalability, AI powered automation etc. are good offerings from QRadar. And I like these features. Review collected by and hosted on G2.com.

I found some difficulties in the initial setup, customization limitation, delayed response time when load is high. If the organization size is small, then cost to acquire QRadar license can be high which makes it inaccessible. Review collected by and hosted on G2.com.