G2

Sanjib kumar D.

Information Technology Security Specialist

Small-Business (50 or fewer emp.)

10/1/2026

"Time Tested Enterprise SIEM with Powerful Integration, Custom Rules, and Automation"

4.5/5

What do you like best about IBM QRadar SIEM?

We can integrate events, flows, and vulnerability data, correlate information from different security controls, create our own rules and building blocks, and automate responses. It also offers a solid range of built-in DSMs, so integrating standard technologies is relatively straightforward, while custom log sources can still be handled when needed.

The UI is mature, and the team is working hard to modernize it. QRadar also requires proper sizing, tuning, and engineering to achieve the best performance and ROI. Overall, I see it as a mature enterprise SIEM that gives a SOC team a lot of control over detection, investigation, and response. Review collected by and hosted on G2.com.

What do you dislike about IBM QRadar SIEM?

The current licensing is mainly based on EPS. It would be beneficial to also offer a log-volume-based licensing model or greater flexibility.

For each device type, QRadar should also provide a ready-made content pack containing recommended use cases, key fields, event IDs, rules, and building blocks. Review collected by and hosted on G2.com.

What problems is IBM QRadar SIEM solving and how is that benefiting you?

QRadar provides centralized visibility across our environment by collecting and correlating events, flows, and vulnerability data in one platform. It helps us detect threats, investigate incidents, reduce false positives, and prioritize security alerts.

It also helps our SOC team automate detection and response, improve investigation efficiency, and generate security reports, reducing manual effort and improving our overall security monitoring. Review collected by and hosted on G2.com.