IBM QRadar Review

Provides user behavior analytics.


What is most valuable?

  • User behavior analytics.
  • Alert features on any suspicious activities.
  • It contributes a lot of knowledge towards your network environment.

How has it helped my organization?

You can add value once you connect a lot of syslogs of a lot of applications to the actual SIEM product. It pretty much does the monitoring of our network, so just having the tool secures the environment itself.

What needs improvement?

I don't have any particular suggestions at the moment, but giving the ability to their business users to leverage the functionality well is important. Right now, the way we use it internally is mainly just for our security team, but other products, like Splunk, for instance, do monitoring on not only the network but also monitoring of system performance.

Server performance is important, whether or not the application is up or down or things of that nature.

What do I think about the stability of the solution?

The product is very stable.

What do I think about the scalability of the solution?

The product is very scalable.

How is customer service and technical support?

Technical support is good. It's not great, it's good. When you leverage the tier 1 folks just to do some troubleshooting, it takes a bit of time to transition a case over. They could improve that turnaround time, especially when the first level guy doesn't know exactly what's going on or doesn't know the answers to the questions.

How was the initial setup?

I wasn't directly involved in the initial implementation. I wouldn't say it's complex, but I mean just by enabling different data sources, you can go crazy with it and enabling them all in one shot is just too much.

Taking your time is probably a better approach so, that way, things operate smoothly and you can fine-tune things as you start seeing the network activity.

What other advice do I have?

Ensure that it's scalable and that you have good customer support. Also, take your time doing the implementation.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Add a Comment
Guest
Sign Up with Email