IBM QRadar Review

Analytics and reporting of user behavior helps to find anomalies and suspicious events


What is our primary use case?

Our primary use for this solution is to collect and correlate our logs. We also create appropriate alarms based on the contents of the logs.

How has it helped my organization?

This solution provides me with various alarms, and I have found security issues with some of my other products. We also have some special correlation rules that give me information about mail servers, websites, and other user behavior.

What is most valuable?

The most valuable feature is user-behavior analytics, where it will create logs based on the users' behavior and report suspicious events or other anomalies. I am working with the data analytics so it is a very good one for what I am doing. 

What needs improvement?

There is a lot of manual configuration required in order for the product to run smoothly, and I think that it could be made more automatic. There is no need for so much manual configuration. For example, it should be able to automatically create at least some of the rules that are suitable for our environment.

The solution has a good user interface, but it could be further developed. I have used other products that are more user-friendly. I would rate the user interface a six out of ten.

For how long have I used the solution?

Between three and five years.

What do I think about the stability of the solution?

We have not experienced any bugs or vulnerabilities, so the stability seems to be fine.

What do I think about the scalability of the solution?

The scalability seems great.

We have five hundred people in our company. All of them are end-users, except for myself and one of my colleagues who are administrators. We have more that one hundred assets, such as databases, that are monitored by this solution.

How are customer service and technical support?

I have never used technical support for this solution.

How was the initial setup?

The initial setup for this solution is very easy. It is an image file, and we haven't had any difficulties in the setup. After installation, there are many things to do. Again, the difficult part is the configuration of the product.

The installation period was very short, at perhaps one or two weeks. The configuration takes six months or more.

What about the implementation team?

We have a technology company, and we are working with them for deployment and maintenance. They spend one or two hours per week maintaining this solution.

What was our ROI?

We have not calculated ROI.

Which other solutions did I evaluate?

I am familiar with products from other vendors, such as McAfee. We specifically evaluated Splunk, which is a good solution but there is no local partner in Turkey for support. Having a local partner is very important to us.

We chose this solution because we have a good relationship with IBM, and they are able to provide us with local support.

What other advice do I have?

There are many good products and solutions on the market, but for implementation and maintenance, I can say that the most important thing is local support.

We do not have any issues with this product, and we have seen the benefits of it. It is easily configured and installed, and we have a local team to support it. It does have issues in terms of user experience, however.

I would rate this solution an eight out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
1 visitor found this review helpful
Add a Comment
Guest
Sign Up with Email