IBM Security QRadar SIEM v7.5.0UP4 (BYOL)
IBM Security | IBM Security QRadar SIEM v7.5.0UP4 (BYOL)Linux/Unix, Red Hat Enterprise Linux 7.9 - 64-bit Amazon Machine Image (AMI)
Reviews from AWS Marketplace
0 AWS reviews
-
5 star0
-
4 star0
-
3 star0
-
2 star0
-
1 star0
External reviews
External reviews are not included in the AWS star rating for the product.
An Easy to Implement SIEM Solution
What do you like best about the product?
I have worked on multiple SIEM solutions and find Qradar easy among them to onboard log sources. Also, it supports a wide range of log sources integration as Out of Box. Though the custom rule set present is not that useful, creating new rules is easy compared to other SIEMs.
What do you dislike about the product?
The UI is not very friendly for security guys. Also the search query language is complicated to work with. While searching data for long durations, Qradar becomes irresponsive. Difficult to understand how event buffer works; hence often observe event drops.
What problems is the product solving and how is that benefiting you?
The SIEM solutions help gather logs from various tools used across the organization and perform correlation on them to check for any abnormal or malicious behavior. They also alert analysts to avoid any significant compromise or breach.
- Leave a Comment |
- Mark review as helpful
Good SIEM product to use with impressive threat intel feeds
What do you like best about the product?
The threat intel feeds integrated with QRadar is excellent and very insightful.
The GUI of the tool is also really impressive and is well constructed for analysts.
The GUI of the tool is also really impressive and is well constructed for analysts.
What do you dislike about the product?
The license cost is really expensive and customisation requests and use cases that that are required to be configured cost extra each time. Support team take a long time to respond.
What problems is the product solving and how is that benefiting you?
IBM QRadar is a useful SIEM tool that helped add to our portfolio of offerings along with our MDR services. It also gives good insights into latest cyber threats and log types for monitoring team.
One of the best SIEM tool in the market
What do you like best about the product?
QRadar UI is very user-friendly. It doesn't require query-based search like other leading SIEM tools in the market. Its graphs and reports also provide detailed information about your Infrastructure.
What do you dislike about the product?
I don't find any downsides to QRadar. It might be because QRadar was the first SIEM tool I used in my career. Later I used other tools but found QRadar to be the best.
What problems is the product solving and how is that benefiting you?
With more than 40,000 computers and servers involved, it becomes difficult to track and prevent your infrastructure against security attacks. IBM QRadar makes soc teams' life easy by getting rid of false positives and providing detailed information about attacks.
One stop SIEM solution
What do you like best about the product?
QRadar can be a one stop SIEM someone with its capabilities to integrate with TI feeds and UEBA. Is very easy to use and takes the focus off of the tool to help focus on what's important- Security.
What do you dislike about the product?
The UI looks pretty outdated and boring and could be worked upon. Compared to its rivals like Splunk and other MDR tools that are now taking over the market, QRadar looks very bland.
What problems is the product solving and how is that benefiting you?
Helps deliver accurate and timely security alerts to our clients. Can also be used to perform proactive threat hunts to make sure that the clients are safe from security threats.
Perfect SIEM solution to depend against threats.
What do you like best about the product?
The flexibility that QRadar offers helps security team deduct, understand and prioritize threats to the environment. Also it performs in depth network forensics and store complete network logs.
What do you dislike about the product?
It could be complicated for beginners, prior knowledge is required to operate. Threat analysis could be more simplified and also managing the database of threat reports is not easy.
What problems is the product solving and how is that benefiting you?
It provides automative solution of threat protection. There are advanced search queries which are easy to understand which allows user to perform specific searches that really speed up the investigation.
In-depth network forensics and integration with other tools
What do you like best about the product?
It helps in threat detection and response solution to remediate the threat. It has open architecture to deploy on premises, on cloud or as a service. We can integrate EDR, SIEM, SOAR and other threat intelligence while leaving data where it is for to complete the XDR approach.
What do you dislike about the product?
The EPS cap limits the amount of logs that can be integrated in Qradar can generate many false positives. Not a much user friendly, a bit difficult to set the rules.
What problems is the product solving and how is that benefiting you?
It is a good solution to monitor,investigate detect and respond to threats on devices and endpoints of the environment. Logs retention capability is good. It collate large amount of data from the cloud and on-site sources.
Can't prefer QRadar alone but prefer to use with SOAR concepts
What do you like best about the product?
It has variety of searches that you can easily do and correlation queries can be easily altered
What do you dislike about the product?
I am not a fan of Qradar View. when I see it I feel that's a pretty outdated view.
What problems is the product solving and how is that benefiting you?
When it is connected with XSOAR the user experience is better as alerts are directly linked and synced.
Best SIEM for small to medium organizations
What do you like best about the product?
Easy to integrate with other tools, availability of extentions, simple rule creation, good customer support, large community to discuss queries, able to trigger alertsin real time
What do you dislike about the product?
Tool is very bulky due to this problems occurs during upgrading, search is slow if data is High, some time refrence set cause problem
What problems is the product solving and how is that benefiting you?
It is event management system, Central console to collect all events, you can build rules to trigger alerts for anomalies
Best SIEM product in the market. Easy to integrate new devices and other security technologies.
What do you like best about the product?
Simple GUI and ease to configure rules, dashboards, reports and searches
What do you dislike about the product?
There are issues related to the wincollect agent wherein the services stops automatically and log reception stops
What problems is the product solving and how is that benefiting you?
Compliance
security
visibility
Threat intelligence
security
visibility
Threat intelligence
Overall experience was really good using the tool.
What do you like best about the product?
Integration of almost all the types of different devices makes it a very useful and very capable tool for monitoring the infrastructure. Availability of the documentation also helps in resolving any kind of issue.
What do you dislike about the product?
Upgrading to a newer version is a little bit hectic task. This is the one thing that I don't like about this tool. Apart from that everything is good and smooth.
What problems is the product solving and how is that benefiting you?
It gives a wide picture of cyber threats which are external and internal. The more devices you integrate the broader picture you get of your system. Various use cases and building blocks are just cherries on top.
showing 51 - 60