We performed a comparison between IBM Security QRadar and Splunk User Behavior Analytics based on real PeerSpot user reviews.
Find out in this report how the two User Entity Behavior Analytics (UEBA) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."One very useful feature is the plug-in offering that allows you to integrate it with other solutions, such as integrating it with plug-ins like Scout, Carbon Black, and the rest."
"The features that I have found most valuable in QRadar are its data enrichment, use case creations, and adding references - those kinds of features are very good. Also QRadar's event filtration and device integration are perfect."
"It's built around Red Hat Linux, which is highly robust."
"This is a good tool to have because it gives you the ability to track what is currently happening in your environment."
"The most valuable thing about QRadar is that you have a single window into your network, SIEM, network flows, and risk management of your assets. If you use Splunk, for instance, then you still need a full packet capture solution, whereas the full packet capture solution is integrated within QRadar. Its application ecosystem makes it very powerful in terms of doing analysis."
"It does good correlation for events. It does good general analysis, and it has good apps as well."
"The solution is reliable."
"Network-Based Anomaly Detection (NBAD): Using NetFlow, JFlow, SFlow, or QFlow (all 7 layers), offenses are detected as a response when a rule is triggered."
"Because of some of the visualizations that we utilize, we are able to understand strange, unusual traffic on our networks."
"Splunk is more user-friendly than some competing solutions we tried."
"The solution appears to be stable, although we haven't used it heavily."
"This intelligent user behavior analytics package is easy to configure and use while remaining feature filled."
"The product is at the forefront of auto-remediation networking. It's great."
"It's easily scalable."
"The solution is fast, flexible, and easy to use."
"The most valuable features are the indexing and powerful search features."
"Their technical support is not good. We opened a lot of cases and from my experience, they are not complicated issues but it takes forever to get an answer."
"The usability of interfaces could be improved."
"There is room for improvement in IBM QRadar in integrating features for SOC maturity and security levels directly into QRadar."
"Needs better visualization options beyond the time series charts and a few other options that they have."
"QRadar needs to be improved on the storage side, particularly when the disc exceeded the maximum threshold."
"I would like the rule creation interface to be much more user-friendly in the next release."
"The architecture could be improved. I got stuck for a long time trying to understand the architecture, as it is quite challenging."
"There was some complexity in the initial setup due to bandwidth issues."
"The correlation engine should have persistent and definable rules."
"There are occasional bugs."
"We want to have an automated system for bot hunting that enables us to detect anomalies predictively based on historical data. It would be helpful if Splunk included process mining as an alternative option. We have a threat workflow, but it would be useful if we could supplement that with some process mining capabilities over time."
"Currently, a lot of network operations need improvement. We still need people to handle incidents. Our vision is to leverage status and convert it directly from the network devices. It would be ideal if we could take action using APIs and API code and remove manual processes."
"We'd like the ability to do custom searches."
"The solution is much more expensive than relative competitors like ArcSight or LogRhythm. It makes it hard to sell to customers sometimes."
"The ability to do more complicated data investigation would be a welcome addition for pros, though the functionality now gives most people what they need."
"The price of Splunk UBA is too high."
More Splunk User Behavior Analytics Pricing and Cost Advice →
IBM Security QRadar is ranked 1st in User Entity Behavior Analytics (UEBA) with 198 reviews while Splunk User Behavior Analytics is ranked 2nd in User Entity Behavior Analytics (UEBA) with 17 reviews. IBM Security QRadar is rated 8.0, while Splunk User Behavior Analytics is rated 8.2. The top reviewer of IBM Security QRadar writes "A highly stable and scalable solution that provides good technical support". On the other hand, the top reviewer of Splunk User Behavior Analytics writes "Easy to configure and easy to use solution that integrates with many applications and scripts ". IBM Security QRadar is most compared with Microsoft Sentinel, Splunk Enterprise Security, Wazuh, LogRhythm SIEM and Cortex XSIAM, whereas Splunk User Behavior Analytics is most compared with Darktrace, Microsoft Defender for Identity, Varonis Datalert, Cynet and Exabeam Fusion SIEM. See our IBM Security QRadar vs. Splunk User Behavior Analytics report.
See our list of best User Entity Behavior Analytics (UEBA) vendors.
We monitor all User Entity Behavior Analytics (UEBA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.