IBM Security QRadar SIEM v7.3.2 P1 - Console (BYOL)
IBM Security | QRadar Console v7.3.2 Patch 1Linux/Unix, Red Hat Enterprise Linux RHEL-7.5 - 64-bit Amazon Machine Image (AMI)
Reviews from AWS Marketplace
0 AWS reviews
-
5 star0
-
4 star0
-
3 star0
-
2 star0
-
1 star0
External reviews
External reviews are not included in the AWS star rating for the product.
QRadar app development
What do you like best about the product?
The ease of integration, correlation,distributed environment setup.
What do you dislike about the product?
Highly unstable when creating or deploying custom apps.
What problems is the product solving and how is that benefiting you?
Creating efficient apps .
Recommendations to others considering the product:
It's a good product,easy to use product.
- Leave a Comment |
- Mark review as helpful
Qradar: Bringing Security Into Focus
What do you like best about the product?
I enjoy and appreciate the ecosystem surrounding Qradar. Between the support community and the X-Force Exchange, there is a wealth of resources to ensure success.
What do you dislike about the product?
Qradar is a very complex product that takes a LOT of care and feeding.
What problems is the product solving and how is that benefiting you?
Qradar allows me to bring my entire environment into quick focus to find and realize issues and incidents effectively.
Recommendations to others considering the product:
Like any other enterprise tool, much of your success is contingent on your manpower and understanding of the underlying technology. A lot of companies are under staffing SIEM technology which severely degrades the value add.
Good correlation
What do you like best about the product?
Good correlation and easy to use. Lot of OOTB rules with use cases.
What do you dislike about the product?
Web user interface usability could be better.
What problems is the product solving and how is that benefiting you?
very good as siem.
The best SIEM Available
What do you like best about the product?
Great tuning capability, intelligence service allows to automatically generate offenses and the capability of adapting to any kind of infrastructure.
What do you dislike about the product?
Visually is not the best, the web browser offers an intuitive GUI but some functions are not presented really well.
What problems is the product solving and how is that benefiting you?
Monitoring customers infrastructure from deployment to full installation, giving also SOC service.
Good security system
What do you like best about the product?
The security system we just started to use. it helps identify and prioritize many threats. menu seems a bit complicated, but you can filter by yourself. All available in offenses
What do you dislike about the product?
everything looks nice now. We did not encounter any problems.
What problems is the product solving and how is that benefiting you?
To be aware of the advanced threats such as security of all devices in our corporate network, opening user account other than information outside of working hours, long-term usage of VPN.
Excellent tool for SIEM Technology
What do you like best about the product?
The ability to write complex rules with lot of ease. It helps correlate lot of log sources and can help write/define better rules which can help address complex rules. The features to add multiple apps from various vendors to better represent the dashboards and various lookup integrations. Incident Management and Automation for the script triggers and having them integrated with tools like IBM Resilient which helps managing the incident response process.
What do you dislike about the product?
There is nothing much to dislike in the system, however the Dashboard options and representation can be better. Pulse has some compensation however, we need to share those JSON files and all which is complex and not user friendly again.
Also the support for OT environment related log sources can be looked into as well. However, the dashboards and reports are the main concern points which we have seen with multiple customers.
Also multiple threat intel features can be recommended just like the IBM Resilient free threat intelligence options, instead of just keeping the TAXI/STIX feeds available, it would be great if you can recommend the customer on what and how to use them based on the open feeds that are actively available in opem.
Also the support for OT environment related log sources can be looked into as well. However, the dashboards and reports are the main concern points which we have seen with multiple customers.
Also multiple threat intel features can be recommended just like the IBM Resilient free threat intelligence options, instead of just keeping the TAXI/STIX feeds available, it would be great if you can recommend the customer on what and how to use them based on the open feeds that are actively available in opem.
What problems is the product solving and how is that benefiting you?
Complex rule monitoring. Multiple Correlation rules. Automatic Trigger of Incident Response tickets. Better visibility to the network and event logs.
QRadar SIEM Review and Comparision
What do you like best about the product?
QRadar App Exchange
Log Source Integration and Custom Content Extraction from raw event
QRadar Network Insight
ADE - Anomaly Detection Engine
Log Source Integration and Custom Content Extraction from raw event
QRadar Network Insight
ADE - Anomaly Detection Engine
What do you dislike about the product?
No correlation Rule can be written if log sources integrated with different event processors
Support (Specially Indian support) is not much technical and not able to resolve issues on timely manner
Support (Specially Indian support) is not much technical and not able to resolve issues on timely manner
What problems is the product solving and how is that benefiting you?
Traffic profiling and triggering alerts for abnormalities
Recommendations to others considering the product:
I have worked on multiple SIEM Tools and found QRadar SIEM is stable, flexible and have more features compared to other SIEM Tools I worked including RSA SA, Symantec SSIM, ArcSight, McAfee Nitro.
Simply the best!
What do you like best about the product?
Powerful tool that can monitor almost anything. Happy that they offer free training on it as well. It works well with the entire Security immune suite from IBM. It's rated number one in gartner's magic quadrant for SIEM's. Brilliant product.
What do you dislike about the product?
It can get complicated and difficult to understand at time. licencing is very expensive and can limit what you want to use Qradar for. It's difficult to get practical experience due to the lack of test environments. There's not a big footprint in Africa. customers lack the skills and it can be difficult to get to the to offer support and training.
What problems is the product solving and how is that benefiting you?
single point to manage Security Event Information Management. Love how flexible the product is and how easy it is to integrate. Threat intelligence and full protection in terms of the kill chain analysis. Network traffic, events and offenses can be query from a single console. very nice indeed
Recommendations to others considering the product:
Power product, It's simply the best
QRadar helping university IT department with the many threats that are bombarding it
What do you like best about the product?
I like QRadar's intuitiveness and ease of use. As a member of the IT department I use QRadar daily to look for anomalies and troubleshoot issues. QRadar helps all our staff from the systems and network teams to the security analysts.
What do you dislike about the product?
There are some search features that are disappointing. If I put a filter on a search, but make a mistake with it, I have to delete the filter and then add the proper one instead of just editing the one I made the mistake in.
What problems is the product solving and how is that benefiting you?
We have it daily for troubleshooting network issues. Looking for troublesome users, bots, malicious actors and much more. As a University we have to look at threats coming from the outside world, as well as troublesome students trying things out due to curiosity or unfortunately the occasional one who is being malicious.
Recommendations to others considering the product:
Don't expect it to be the tool that will save your day by just turning it on. It takes time to tune the product. It is a little bit of rinse and repeat. You tune QRadar and let it sit for a bit and then you find some offenses that aren't really offenses and you tune some more. Overall QRadar is exactly what you put into it. If you spend the time investigating issues and tuning rules you will get a clean set of offenses for you to investigate.
the most competent SIEM
What do you like best about the product?
all in one, integrations, scalability.
It is the most competent product on the market with many thing out of the box and easy to build own integrations
It is the most competent product on the market with many thing out of the box and easy to build own integrations
What do you dislike about the product?
pricing, the pricing by EPS and Flows can be very very expensive, its hard for a small company to invest in this product
What problems is the product solving and how is that benefiting you?
Normalizing by many different products
showing 321 - 330