Sold by: IBM SecurityÂ
Deployed on AWS
The threat detection and response suite built to help your security teams outsmart threats with speed, accuracy and efficiency. IBM Security QRadar SIEM (Classic) and QRadar SOAR are customer deployed software.
4
Overview
Threats are increasing in volume and sophistication at a staggering pace. Real-time monitoring and visibility are required to detect threats like ransomware, insider threats, and cloud attacks before they cause disruption.
IBM Security® QRadar® Suite is a modernized threat detection and response solution designed to unify the security analyst experience and accelerate their speed across the full incident lifecycle. The portfolio is embedded with enterprise-grade AI and automation to dramatically increase analyst productivity, helping resource-strained security teams work more effectively across core technologies.
IBM Security QRadar SIEM (Classic): Market-leading Security Information and Event Management (SIEM) solution enables you to run your business in the cloud and on premises with visibility and security analytics built to rapidly investigate and prioritize critical threats.
IBM Security QRadar SOAR: Recent winner of a Red Dot Design Award for interface and user experience, QRadar SOAR helps organizations automate and orchestrate incident response workflows and ensure their specific processes are followed in a consistent, optimized and measurable way.
For more information, visit https://www.ibm.com/qradarÂ
For customized QRadar SIEM (Classic) / QRadar SOAR pricing or if you are interested in additional product capabilities such as Threat Intelligence, Data Explorer, or EDR - contact your IBM Sales Representative or email us at SecurityOrdersAWS@wwpdl.vnet.ibm.com .
Highlights
- Find the right size for your solution and estimate your IBM QRadar SIEM (Classic Software) price: https://www.ibm.com/qradar/security-qradar-siem/pricing?mpid=aws
- Gain centralized visibility across AWS and hybrid cloud environments via a single pane of glass. Leverage deep integrations with AWS security services including AWS Security Hub, CloudTrail, GuardDuty, Network Firewall, WAF, Amazon Detective, CloudWatch, VPC Flow Logs and more.
- Correlate data across users, networks, and AWS native services to gain deep insights into key threats including cloud misconfigurations, policy changes and suspicious user activity. Connect related events to ensure teams only receive a single alert for an incident.
Details
Sold by
Categories
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Buyer guide
Gain valuable insights from real users who purchased this product, powered by PeerSpot.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
QRadar SIEM | 500 Events Per Second, 10000 Flows Per Minute | $12,074.40 |
QRadar SOAR | 2 Authorized Users | $22,704.00 |
Vendor refund policy
All orders are non-cancellable and all fees and other amounts that you pay are non-refundable. If you have purchased a multi-year subscription, you agree to pay the annual fees due for each year of the multi-year subscription term.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA)Â .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
For Sales Inquiries Contact: SecurityOrdersAWS@wwpdl.vnet.ibm.com To contact IBM Security QRadar Suite Software support:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Updated weekly
By IBM Security
By Rapid7
By Panther
Sentiment is AI generated from actual customer reviews on AWS and G2
Functionality
Ease of use
Customer service
Cost effectiveness
Positive reviews
Mixed reviews
Negative reviews
AI generated from product descriptions
Threat Detection and Analytics
Advanced security information and event management (SIEM) solution with real-time monitoring and threat detection capabilities
Cloud Security Integration
Deep integration with AWS security services including Security Hub, CloudTrail, GuardDuty, Network Firewall, and VPC Flow Logs
Incident Response Automation
Enterprise-grade AI and automation to orchestrate and streamline incident response workflows across security technologies
Event Correlation
Ability to correlate data across users, networks, and cloud services to provide comprehensive threat insights and minimize alert fatigue
Multi-Environment Monitoring
Unified security analytics platform supporting monitoring and visibility across cloud and on-premises infrastructure
Log Aggregation and Monitoring
Monitors entire IT environment by ingesting logs from CloudTrail, GuardDuty, EC2 network traffic, multiple AWS accounts, cloud services, on-premises networks, and remote endpoints
Threat Detection Analytics
Utilizes user and attacker behavior analytics with 900+ out-of-the-box detections and community threat intelligence to minimize false alarms
Compliance Monitoring
Supports log, event, and File Integrity Monitoring (FIM) requirements for compliance frameworks like PCI, HIPAA, and GDPR
Advanced Defense Mechanisms
Implements layered security defenses through honeypots, honey credentials, and honey files to detect potential intrusions
Investigation Capabilities
Provides detailed log timelines and automated response workflows to cut investigation times and enable rapid incident response
Log Analysis
Real-time security log processing and analysis of terabytes of raw logs per day using cloud-native architecture
Detection Methodology
Detection-as-code implementation using Python programming language for threat detection rules
Cloud Log Integration
Native integrations with AWS log sources including S3, CloudTrail, and VPC Flow Logs
Security Data Lake
Transforms raw log data into structured security data lake for comprehensive threat investigation and incident response
Scalable Architecture
Highly scalable data lake infrastructure designed for processing and querying large volumes of security logs efficiently
Standard contract
No
No
No
Customer reviews
Mohamed Fouad
Building a proactive soc has improved threat correlation and deep log investigation
Reviewed on Dec 03, 2025
Review from a verified AWS customer
What is our primary use case?
My main use case for IBM Security QRadar is building a SOC with IBM Security QRadar as a SIEM.
I use IBM Security QRadar in my SOC operations as an information security management, security and event management tool, to correlate events and build use cases for incident response.
My main use case helps us to deep dive into the logs and correlate events from many other products like firewalls, endpoints, and also a lot of products.
What is most valuable?
The best features IBM Security QRadar offers include vulnerability management, a powerful integration, and being a stable product. The vulnerability management feature helps to build an asset library for our organization, and with integrations, we can integrate this vulnerability with other ticketing systems to discover new vulnerabilities and build a patch management for it.
IBM Security QRadar has positively impacted my organization by allowing me to get offenses and threats into our organization, helping me to discover the real threats attacking our organization. The real threats that IBM Security QRadar helps us with are provided as offenses, real offenses with real examples that allow us to discover new offenses and assist in closing these offenses.
What needs improvement?
IBM Security QRadar can be improved; perhaps IBM support needs improvement in fast response and also the team response.
For how long have I used the solution?
I have been using IBM Security QRadar for about nine years.
What do I think about the stability of the solution?
IBM Security QRadar is stable.
What do I think about the scalability of the solution?
IBM Security QRadar's scalability is great; you can have a new collector to deploy if you have increased EPS per second.
How are customer service and support?
Customer support for IBM Security QRadar needs improvement.
How would you rate customer service and support?
Negative
Which solution did I use previously and why did I switch?
I have not used a different solution before IBM Security QRadar; this is my first use.
What was our ROI?
I have seen a return on investment; I can share that it includes time saved, money saved, and fewer employees needed.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing is great compared to the other vendor.
Which other solutions did I evaluate?
I did not evaluate other options before choosing IBM Security QRadar.
What other advice do I have?
IBM Security QRadar is stable and has great support.
I advise others looking into using IBM Security QRadar that it is really helpful for building a SOC and to get a deep dive into your real threats at the earliest time. I have given this product a review rating of 10.
HarshBhardiya
Have managed daily asset and alert monitoring effectively but have encountered limitations with manual processes and interface usability
Reviewed on Oct 28, 2025
Review from a verified AWS customer
What is our primary use case?
The use cases are daily monitoring, asset management, asset monitoring, asset health status monitoring, and alert monitoring. That is the current use case of what SIEMÂ is being used for.
What is most valuable?
The query search and log fetching are really helpful in IBM Security QRadar when compared to other tools.
Compared to ArcSight, Splunk, or any other SIEM tools where you need their processing language such as structured query language, SPL, and in Sentinel there is KQL query languages, IBM Security QRadar doesn't require reliance on query languages. There are filters which you can use directly and apply to get the data you want fairly easily.
What needs improvement?
It's still very manual and doesn't work on its own. It's still in an early stage and not on par where we can consider it a really successful detection system. The accuracy is not there.
The UI could be better when compared to Sentinels where we can use flags and tagging. It could be much more user-friendly. IBM Security QRadar has all features and is fully competitive with other SIEM tools, but when it comes to user-friendliness, a new user takes time to get used to it. More intuitive, user-friendly interfaces and more helpful documentation would be beneficial.
The query searching and data fetching could be faster. In large to very large organizations with around 5,000 or 6,000 assets or beyond, even with proper configurations and RAM and hardware backing up, the query is fairly slow.
For how long have I used the solution?
I have been using it for almost nine months.
What do I think about the stability of the solution?
The solution is extremely stable because it's on cloud. On cloud, you don't see any disconnections or instability. Any solution that is on cloud works really stably.
What do I think about the scalability of the solution?
I am both a customer and we provide service to that.
How are customer service and support?
I never needed to reach out to support because most of the expertise was already available.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
How was the initial setup?
There are analytical workspaces where we create automatic ticket creations and automatic email notifications.
What about the implementation team?
I have worked on technologies including Qualys, Group-IB, and QRadar. I have experience with CrowdStrike EDR and Bitdefender. On the EDR front, I have worked on CrowdStrike and Bitdefender. For SIEMs, I work with IBM Security QRadar and Sentinel. For vulnerability assessments, I work with Qualys.
What was our ROI?
There are no observable benefits on ROI process-wise, workability-wise, or usability-wise.
Which other solutions did I evaluate?
We chose IBM Security QRadar because we were moving to cloud. Previously it was an on-prem solution. Compared to Splunk and Sentinel, it's much more cost-effective.
What other advice do I have?
IBM Security QRadar is capable of handling much of the market requirements. It's comparable to any other SIEM tool without standing out significantly.
It's fairly open for custom integrations, but it depends on what type of logs we are receiving and what kind of parsing we are getting done. The integrations are totally based on the skill sets if third-party or custom integrations are required.
When it comes to log management, it's fairly easy to manage and the log rotate is really good compared to any standard SIEM tool. It just gets the work done.
I rate IBM Security QRadar an 8 out of 10.
Francisco JavierRomo
Has provided fast deployment with out-of-the-box use cases and improved threat detection through integrated AI tools
Reviewed on Oct 21, 2025
Review from a verified AWS customer
What is our primary use case?
In IBM Security QRadar , I used to work for a company that wanted to implement AI, generative AI, to help financials and banks improve their process of software development, including testing for their tools and all the releases they are doing for the improvements of the applications of software on the cloud.
What is most valuable?
IBM Security QRadar 's AI and machine learning capabilities for threat detection and response are exceptional, and Q Site is used to create panels and visualizations of software development processes. It's really fast and impressive compared to QuickSight . The detector library contributes significantly to its functionality. The main importance is the releases without any kind of security breaches, and IBM Security QRadar gives the opportunity to improve the time to market of the releases with a great evaluation of cybersecurity breaches. It's currently the top solution in the industry.
What needs improvement?
I assess the integration of third-party technologies with IBM Security QRadar's open architecture as lacking compared with what is available, because there are more genesis and solutions, but nothing compares with AWS cloud solutions. The top integrations happen here. The only difficulty is when integrating with ServiceNow ; solutions from Microsoft, Google, Rackspace are really complex to integrate with ServiceNow , but Amazon is easier than other solutions.
I'm talking about IT Operation Management or hardware as management, DevOps or SecOps of ServiceNow, and those are really complex use cases to integrate with third parties, but Amazon does it better.
Overall, I would rate IBM Security QRadar an 8.5, because it depends on the use case, but there should be more focus on small and medium businesses, especially given the number of FinTechs and entrepreneurs in Mexico that require easier solutions with less budget. AWSÂ Cloud is amazing for macro projects on software development, but it needs to be more accessible for SMBs, which is why I give it an 8.5; there's room for improvement in that area.
For how long have I used the solution?
With AWS as a cloud provider, I used to work for a company that implements solutions for AWS cloud solutions.
How are customer service and support?
I would rate their customer service or technical support as the best in Mexico. The only issue is the language barrier sometimes, because customer support services are used from India, and that can be challenging. While I speak English, it's difficult to understand some accents. However, besides that, local support in Mexico has people ready to provide level one, level two, and level three support. When something complex arises, the ticket gets transferred to India or to third parties not in Mexico, but it's very difficult to scale a ticket that far. The customer support located in Mexico speaks Spanish and they help to resolve issues, depending on the agent.
How would you rate customer service and support?
Neutral
How was the initial setup?
For the initial setup of IBM Security QRadar, you need to have the right people, but if you are a newbie to these kinds of solutions and want to do out-of-the-box implementations, Amazon provides out-of-the-box use cases that you can implement immediately, and the personalization is easy to accomplish.
What was our ROI?
In terms of return on investment, I have worked on exercises where the payback occurs within three or four months, which is very good for a cloud solution because implementation cycles can be really long. AWS gives the chance to implement a solution out of the box with use cases that are already in IBM Security QRadar. Solutions such as Q Business, Q Site, QuickSight are already out of the box, so implementing and configuring a use case takes about two to three months, with the payback being almost immediate.
What's my experience with pricing, setup cost, and licensing?
The pricing for IBM Security QRadar is not the best, but it's not the worst. It depends on how much you want to spend. The last time I worked with this technology was in 2023. The pricing reflects how much you want to spend for the results you want to have. If you want the best of the best, you go to AWS Cloud.
What other advice do I have?
I rate IBM Security QRadar 8.5 out of 10.
Which deployment model are you using for this solution?
Public Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Mauricio Campiglia
Has supported threat monitoring and data collection but needs to improve usability and feature growth
Reviewed on Oct 01, 2025
Review provided by PeerSpot
What is our primary use case?
We use IBM Security QRadar to monitor, and it's our main source of information. It's our main SIEM platform for our SOC, and we've collected everything on that platform.
We don't use IBM Security QRadar 's Risk Manager; mainly, it was our main tool to collect information and conduct some analytics on logs and events. That's the primary use case we've been utilizing.
What is most valuable?
The best features of IBM Security QRadar are that it's pervasive. You can have IBM Security QRadar in the dust quite easily, and almost everybody knows the platform. Almost nobody's going to say you bought the wrong SIEMÂ if you buy IBM Security QRadar.
The integration of third-party technologies with IBM Security QRadar is one of the high points they have. They integrate with almost anybody, anywhere. There's an integrator tool for almost anything. Everybody talks with IBM Security QRadar because they were the SIEM name of the game, at least in this country. So the integration part is one of their key advantages.
Long ago, IBM Security QRadar enabled us to have some analytics pre-thought for us. When we started with our SOC, we used some log collectors and other tools, and IBM Security QRadar gave us the advantage of having some analytics pre-considered for us. However, that was long ago. It has become just a log and events collector and our main repository of security events.
What needs improvement?
As far as reliability, security, and how it operates, I think it's because they hit first on the market, and then they built upon that, our name alongside the IBM name. Those are the reasons. It's quite awkward to use the platform; it's not intuitive, the learning curve is quite deep, and I really don't understand why it was so pervasive. However, if you have to sell managed security services to some people that use a SIEM, more than half the time you end up with an IBM Security QRadar platform on the other side. The other half you end up with WSO2, at least in Latin America.
I haven't tried IBM Security QRadar's AI and machine learning capabilities for threat detection and response fully enough to evaluate them yet.
We've been building our SOARÂ capabilities with other tools, and we haven't used IBM Security QRadar's Analytics Engine for automating SOC tasks.
We are not using it as we used to, and I think that advantage is fading out, particularly after the selling of the product to Palo Alto. We are considering some roadmaps to get out of IBM Security QRadar right now; that's the truth.
For how long have I used the solution?
We have been using IBM Security QRadar since pre-pandemic; I think maybe 10 to 12 years right now.
How are customer service and support?
I find IBM support to be nice. However, as a former IBMer, I may have had some advantages in getting support because I had some contacts. The support information is correct; you get to the information and access the technical documents you need because the information is there, and they used to care about their product. I don't know how it's going to be once the program is fully under Palo Alto's management.
For the support team, I would rate IBM support an eight, a solid eight. With the support we used to have within IBM, it was good.
How would you rate customer service and support?
Positive
How was the initial setup?
Setting up IBM Security QRadar is difficult; it has a deep learning curve for the analysts, and there are several hurdles to handle to get IBM Security QRadar running on your infrastructures. On the other hand, once you connect the dots, they keep sending the information, and you can continue getting those events.
What's my experience with pricing, setup cost, and licensing?
The pricing, setup cost, or licensing with IBM Security QRadar was costly. It was costly mainly for the things we used to use it for. The customers used to pay the price, but it was one of the problems to onboard some people with IBM Security QRadar. It was costly mainly because of the value you can get right now compared to other solutions.
What other advice do I have?
We are thinking about moving outside of IBM Security QRadar ecosystem due to cost and the belief that some functionalities of new SIEM platforms are surpassing IBM Security QRadar. We think they are not keeping pace with SIEM, which makes it harder for them to differentiate their product or compete against others that are cheaper and easier to deploy.
If you had asked me this question five or seven years ago, I would have given it a solid 10, maybe a nine, but today I believe they are losing track of that. The overall rating for IBM Security QRadar is seven out of ten.
We were partners when they were under IBM. We've been in an IBM program of MSSPÂ for Latin America, so we were partners of IBM Security QRadar when it was within IBM. However, with the selling to Palo Alto this year, we lost that partnership and are now just customers of a reseller.
We operate the platform for our customers. We don't have IBM Security QRadar for our own use.
Jwal Patel
User-friendly interface facilitates quick adaptation and effective threat response
Reviewed on Aug 29, 2025
Review from a verified AWS customer
What is our primary use case?
For incident investigating, IBM Security QRadar is used for logs and management. We get all the traffic from there, which gets logged in our system, and then we investigate it.
What is most valuable?
There are many things I appreciate about IBM Security QRadar . I haven't used any other SIEM before IBM Security QRadar, so for me, it is perfect. Sometimes it takes time to load queries, but other than that, it performs excellently.
I would assess IBM Security QRadar's AI and machine learning capabilities as very helpful for threat detection and response. You have to fine-tune it sometimes with your own investigation, as sometimes they give false alerts about our system.
You have to put your own exceptions inside it, and then they won't give you another ticket about those false incidents.
What needs improvement?
Sometimes it takes time to load queries, but other than that, it performs excellently.
For how long have I used the solution?
Personally, I have been using IBM Security QRadar for four months, but my company has been using it for three years.
How are customer service and support?
I would rate their support an 8.5 with IBM. The support is really good; for instance, if a critical ticket is submitted, you will get paged right away as it gets logged, and their analyst will look into it, letting you know as soon as possible so you can work on it. If there is something bad going on or something faulty with IBM Security QRadar, when you reach out to them, they reply in 10 to 20 minutes.
How would you rate customer service and support?
Positive
Which solution did I use previously and why did I switch?
I haven't used any other SIEMÂ before IBM Security QRadar.
What other advice do I have?
I deal with products such as IBM or Elastic solutions. I have experience with IBM Security QRadar, but not with Elastic; however, we are trying to get into Elastic.
We use many different cloud providers as our main cloud provider. AWS is one of those. We did not purchase the IBM Security QRadar product through AWS Marketplace ; that's handled by our IT team.
I work in a dealership industry, specifically in home hardware. It is easy to use; I wasn't familiar with it, but after getting one-on-one training with my senior, I was able to use it very efficiently and learned it quickly.
We use IBM Security QRadar's Risk Manager, but I don't use it directly as it's related to my senior. I investigate it, but those procedures are based on my senior's decisions. I have not used IBM Security QRadar's analytics engine for automating SOC tasks.
The integration of third-party technologies with IBM Security QRadar's open architecture is good; it integrates with other solutions efficiently. I have used it with many different platforms such as SentinelOne and ExtraHop, and it integrates effectively.
My company are customers with IBM. The overall rating for IBM Security QRadar is 9 out of 10.
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)