IBM QRadar vs Splunk

IBM QRadar is ranked 4th in Security Information and Event Management (SIEM) with 49 reviews vs Splunk which is ranked 1st in Security Information and Event Management (SIEM) with 46 reviews. The top reviewer of IBM QRadar writes "Correlates data across our global enterprise and integrates third-party solutions". The top reviewer of Splunk writes "Monitors all machine logins and actions taken on those machines under each user". IBM QRadar is most compared with Splunk, ArcSight and LogRhythm. Splunk is most compared with IBM QRadar, LogRhythm and ArcSight. See our IBM QRadar vs Splunk report.
Cancel
You must select at least 2 products to compare!
+Add products to compare
Most Helpful Review
Find out what your peers are saying about IBM QRadar vs Splunk and others in Security Information and Event Management (SIEM).
283,782 professionals have used our research since 2012.

Quotes From Members Comparing IBM QRadar vs Splunk

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
Pros
Providing real-time visibility for threat detection and prioritization - QRadar SIEM provides contextual and actionable surveillance across the entire IT infrastructure.It is the core of our entire SOX.Due to the skills shortage, we are able to use it from the standpoint of bringing in a lower level employee or a person who may not have security knowledge.We run 65 servers globally with just two people: an engineering person and me.The scalability is awesome, because QRadar includes other solutions in the same console.It showed us where weaknesses were in our environment, so we could actively target those patches first.We have the abilities to monitor each instance which originates on the process along with the performance of each department.It is incredibly easy to deploy. All the appliances are flexible in the roles that they serve and are all managed the in the same way.

Read more »

It is a one stop shop as a full monitoring and alerting solution for operations and application analysis for most of our back-end systems.We used it to create a custom anomaly detection data model to monitor the activity of our back-end services on an hourly basis relative to the past three months of activity.Splunk UBA is useful for fraud detection and for detection of APTs, advanced persistent threats.UBA, User Behavior Analytics, is a key feature.We can ingest and correlate data from virtually any type of system.Capability to expand the functionality through custom code for data inputs, commands, visualization, alerts, and machine learning.Splunk has significantly helped with aggregation and correlation of critical logs. Not having to grep on each individual server has made everyone more efficient.Splunk has facilitated the correlation of information security logs to look for incidents which could cause damage to the company's infrastructure, as well as financial losses from leaks.

Read more »

Cons
AI is superb but need improvements.The technical support is poor. Mostly because when I open a PMR for IBM, I am stuck with Level 1 staff. As an engineer, nothing that I am bringing them does not require Level 2 or Level 3 support.The user interface needs improvement.Do your research before implementing it, because it is tough to implement.For the common needs of clients to fulfill requirements, a real integration with Blueworks Live (BPA modeling tool also from IBM) and a more suitable BPM on cloud solution for midsize customers.Needs better visualization options beyond the time series charts and a few other options that they have.QRadar log integration of various applications can be a tough job at times. There may be occasions when you will not find any QRadar guide on adding logs of a particular application. Even if you come across one, adding a log process is not an easy one.QRadar needs to be improved on the storage side, particularly when the disc exceeded the maximum threshold.

Read more »

It needs to improve the way to install third-party apps and enable installation without logging into splunk.com.I think the machine learning should be emphasized. Now, it's really important to analyze Big Data, data mining. A SIEM solution, like Splunk, needs an improved data mining solution, artificial intelligence.Missing capability for audio/video and image processing.While scheduled reports can be embedded, Splunk dashboard can not be embedded directly without enabling cross origin.DMC should be a little more intuitive with better dashboarding. Seeing the cause of data flow can be tough to track down.Splunk can improve regex/asset analysis as we do not want to crawl until it is done.It can be tough to get a hold of somebody in technical support depending on the complexity of the issue.The Enterprise Security app could be improved. We have had trouble with it working from the first day.

Read more »

Pricing and Cost Advice
A good approach would be to begin with an On Cloud subscription, then later on do a more exact sizing.Pricing and licensing are competitive. Their new licensing options allow logs to bypass the correlation engine for a flat rate, which is also appealing for log data that is compliance-driven for a small amount of money.Pricing (based on EPS) will be more accurate.An X-Force feed is free with QRadar.It is expensive. It is not a product that I can provide for SMBs. It is a program that I can only provide for really large enterprises.The maintenance costs are high.Go through a vulnerability assessment review for price breaks. A virtualized solution will also cut down on cost.IBM's Qradar is not for small companie. Unfortunately, it would be 'overkill' to place it plainly. The pricing would be too much.

Read more »

It is possible to use a developer's license, which is up to 10GB per day of volume traffic, which is usually enough for most use cases.Free Splunk license for PoCs on personal machines and the ability to scale the PoC to an enterprise level app.It can be expensive, especially the licensing costs. However, there is added value in what it can do, not just log aggregation.Splunk is a bit pricier, but the benefits and ROI are huge.It is a pretty high cost solution, but if your organization has the funds, it can bring many benefits.Personnel costs are saved by not having to involve the domain developers from multiple teams when tracing a problem that spans multiple platforms.Truly evaluate the data you want to ingest and go slow. Pulling in data that can provide no use to your mission only wastes data against your license.Our ROI is high.

Read more »

report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
283,782 professionals have used our research since 2012.
Answers from the Community
Rhea Rapps

It depends on the intended purpose of the tool and the type of people implementing it. Q-Radar tends to focus its out-of-the-box reports on compliance reporting, as well as tracking behavior-based tracking that is arduous for the DIY script writer. Having used both, they are both great platforms that take quite a bit of training to fully understand and wring the most value. Once you are at a steady state of log analysis, Q-Radar tends to be more useful on exploring "what we don't know" while Splunk tends to focus on confirming what I suspected, but didn't have the evidence.

If you love scripting and going after known deviations, there are alot of Splunk consultants and expertise for hire. This makes Splunk slightly better for small organizations. If known deviations are "table stakes" and you focus is on exploring risks currently unknown to you...then Q-Radar is the better option, in my opinion. Q-Radar's learning curve used to be slightly steeper than Splunk...but I've heard there is more automation and better training on the Q-Radar in the past few years.

13 February 18

As all consultants say...it depends.
The elements I would factor in are:
1) How they are staffed?
2) What groups outside of security will use this tool?
3) Is this for SIEM or log management?
4) Size of environment

For" how are they staffed" question I think if you have developers and scripting expertise in house then this makes for a strong case for Splunk. If not then Q-Radar may be a better fit.

The next question..."what groups outside the security group with use this tool?". Splunk does a lot of items that are really nice to haves, but don't necessarily fall into the security space. So if folks outside of security team will use the tool and subsequently help fund the endeavor this makes a strong case for Splunk. If this is a pure play security need, then out of the box, I feel this is a strong case for Q-Radar

Is this for SIEM or log management? By default Splunk is not a SIEM, once you buy the SIEM/Security license then it becomes a SIEM. That being said, it does log management and analytics very well. Out of the box Q-Radar is a very effective SIEM with tons of pre-set rules. So obviously if this is a pure play log management move, then Splunk becomes a strong choice here.

Size of environment. Because the Splunk licensing model is based on the number of events being produced in your environment, then this is a factor that must be considered. Q-Radar on the other hand is one of most straight-forward SIEM installations, and shortest time to value out there. As such, they have often been associated with small to mid sized organizations.

There are other factors out there to consider...this is in no means an all encompassing list, however, I feel if you ask yourself these questions, at a minimum , then your answers becomes a lot clearer.

13 February 18

The answer of course is, it depends. They are both great tools. In my experience, Splunk would be viewed favorably by teams that prefer scripting and building their own capabilities. Splunk does also has an add-on ES module that is pre-configured to address many common security/compliance reporting needs. I have less experience with Q-Radar relative to Splunk however I did recommend Q-Radar to a company who wanted something they could deploy rapidly to satisfy a HIPAA reporting requirement. My observation is that Q-Radar may have more compliance-related reporting out of the box relative to Splunk.

13 February 18

We have always used IBM QRadar so I guess I am partial to that solution. I have researched Splunk, LogRhythm, Alien Vault, etc but we just have never made that transition. I am uncertain about Splunk reporting but I agree with Tim in that QRadar does offer extensive compliance-related reporting. I would also add that IBM has done a lot in the past few years to open up their API to partners to allow for a greater interoperability between multiple tools. So the integration between multiple tools is getting better. Unfortunately for us most of those tools are not used in our environment.

13 February 18
Eduardo PerezReal User

I had been looking at the Security Analytics Platforms from the top right quadrant in the Gartner and Forrester reports and found that [architectural] use-case really matters.

For my business I was looking to build a shared environment that would service multiple customers so multi-tenancy, data security, roles based access controls and self-service-ability were key requirements. For the purposes of providing the SOC a single-pane of glass I needed a single configurable dash, and in a single-tenant environment both (Splunk and QRadar) could do it but in a multi-tenanted scenario on one could do it, at least without having to adding unnecessary systems.

Also, I didn't want to spend too much time on integration, setup and configuration so having [SIEM] use cases and compliance reporting available out-of-the-box and integration with common devices and OS had to be part of the base offering allowing the team to install and start using it immediately.

For me QRadar ticked all the boxes. Additionally the vast range of free apps which include user behavioral analytics are available which let you leverage its analytics engine.

That said, Splunk is an effective analytics platform that has use cases outside of SecOps. You will need to have the depth of certified knowledge, expertise and deep pockets to make effective use.

14 February 18
Ranking
RANKING
Views
41,407
Comparisons
26,136
Reviews
45
Followers
2,319
Avg. Rating
8.4
Views
92,806
Comparisons
67,117
Reviews
46
Followers
2,850
Avg. Rating
8.8
Top Comparisons
Top Comparisons
Compared 49% of the time.
Compared 11% of the time.
Compared 11% of the time.
See more IBM QRadar competitors »
Compared 19% of the time.
Compared 14% of the time.
Compared 8% of the time.
See more Splunk competitors »
Also Known As
Also Known AsQRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar
Website/Video
Website/VideoIBM
Splunk
Overview
Overview

The IBM QRadar security and analytics platform is a lead offering in IBM Security's portfolio. This family of products provides consolidated flexible architecture for security teams to quickly adopt log management, SIEM, user behavior analytics, incident forensics, and threat intelligence and more. As an integrated analytics platform, QRadar streamlines critical capabilities into a common workflow, with tools such as the IBM Security App Exchange ecosystem and Watson for Cyber Security cognitive capability.

With QRadar, you can decrease your overall cost of ownership with an improved detection of threats and enjoy the flexibility of on-premise or cloud deployment, and optional managed security monitoring services.

Splunk software has been around since 2006 and the company has since grown to become an industry leader. Splunk's vision is to make machine data accessible, usable and valuable to everybody. The company offers a wide range of products to turn machine data into valuable information by monitoring and analyzing all activities. This is known as Operational Intelligence and is the unique value proposition of Splunk.

Splunk is well-known for its Log Management capabilities and also for its Security Information and Event Management (SIEM) solutions.

OFFER
Learn more about IBM QRadar
Learn more about Splunk
Sample Customers
Sample CustomersClients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Top Industries
Top Industries
REVIEWERS
Financial Services Firm
26%
Transportation Company
19%
Health, Wellness And Fitness Company
7%
Security Firm
7%
VISITORS READING REVIEWS
Financial Services Firm
20%
Comms Service Provider
13%
University
6%
Healthcare Company
6%
REVIEWERS
Financial Services Firm
21%
Retailer
15%
Energy/Utilities Company
12%
University
9%
VISITORS READING REVIEWS
Financial Services Firm
17%
Comms Service Provider
11%
Energy/Utilities Company
7%
Manufacturing Company
6%
Company Size
Company Size
REVIEWERS
Small Business
27%
Midsize Enterprise
13%
Large Enterprise
61%
VISITORS READING REVIEWS
Small Business
24%
Midsize Enterprise
19%
Large Enterprise
57%
REVIEWERS
Small Business
19%
Midsize Enterprise
14%
Large Enterprise
67%
VISITORS READING REVIEWS
Small Business
14%
Midsize Enterprise
19%
Large Enterprise
67%
Find out what your peers are saying about IBM QRadar vs Splunk and others in Security Information and Event Management (SIEM).
Download now
283,782 professionals have used our research since 2012.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.

Sign Up with Email