IBM QRadar vs. Splunk

IBM QRadar is ranked 3rd in Security Information and Event Management (SIEM) with 56 reviews vs Splunk which is ranked 1st in Security Information and Event Management (SIEM) with 49 reviews. The top reviewer of IBM QRadar writes "Correlates data across our global enterprise and integrates third-party solutions". The top reviewer of Splunk writes "Monitors all machine logins and actions taken on those machines under each user". IBM QRadar is most compared with Splunk, ArcSight and LogRhythm NextGen SIEM. Splunk is most compared with IBM QRadar, LogRhythm NextGen SIEM and ArcSight. See our IBM QRadar vs. Splunk report.
Cancel
You must select at least 2 products to compare!
Most Helpful Review
Use Null Product? Share your opinion.
Find out what your peers are saying about IBM QRadar vs. Splunk and others in Security Information and Event Management (SIEM).
301,063 professionals have used our research since 2012.

Quotes From Members Comparing IBM QRadar vs. Splunk

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
Pros
It is really helpful to us from the compliance point of view.The initial setup is not complex or difficult.QRadar has somewhat of a new structure recently from last gen. They have moved from the standard UI based infrastructure.It has improved my efficiency.A nice benefit is when we go to the process of selecting our youth cases, they go by building blocks. QRadar links it to building blocks.It's a state-of-the-art product for security information and event management (SIEM).There are a lot of great out-of-the-box features included.Log correlation is very useful for processing alerts. It serves to follow up alerts in real-time, building an entire workflow.

Read more »

It has virtual visualization, and other products do not.It gives us the liberty to do more in terms of use cases.With good domain knowledge, one can build almost anything. If you throw in Alert Manager or an integration with ServiceNow. Then, you have your own SIEMOur clients are easily able to modify and evolve their implementations.Positive features include replication capabilities, software development kits, and the architecture.It is a one stop shop as a full monitoring and alerting solution for operations and application analysis for most of our back-end systems.We used it to create a custom anomaly detection data model to monitor the activity of our back-end services on an hourly basis relative to the past three months of activity.Splunk UBA is useful for fraud detection and for detection of APTs, advanced persistent threats.

Read more »

Read more »

Cons
The tech support is not that good.The Indian tech support is not helpful.It is not app based.The initial setup was complex, and it took six months.QRadar needs a lot of fine tuningThe quality of technical support depends on the IBM support person. Sometimes, it's hard to get the right person on the other side. A ticket coordinator could be the key to better quality delivery.The released patch quality is poor. IBM should test those patches on their side, not on the client's side.Its architecture is very complicated.

Read more »

We had an instance when Splunk failed and it took us a couple of days to recover.The Web Application Firewall will send you too much information because it's more dedicated to security than a normal firewall.It needs a better way to export dynamic views without requiring a ton of code and user/pw.It needs integration with a configuration management solution.It needs integration with a configuration management solution.The solution could use a different licensing model.An improved user interface along with multi-tenancy support would be beneficial.It needs to improve the way to install third-party apps and enable installation without logging into splunk.com.

Read more »

Read more »

Pricing and Cost Advice
The cost of this product is expensive.It is very expensive.A good approach would be to begin with an On Cloud subscription, then later on do a more exact sizing.Pricing and licensing are competitive. Their new licensing options allow logs to bypass the correlation engine for a flat rate, which is also appealing for log data that is compliance-driven for a small amount of money.Pricing (based on EPS) will be more accurate.An X-Force feed is free with QRadar.It is expensive. It is not a product that I can provide for SMBs. It is a program that I can only provide for really large enterprises.The maintenance costs are high.

Read more »

I have no opinion on pricing.It is possible to use a developer's license, which is up to 10GB per day of volume traffic, which is usually enough for most use cases.Free Splunk license for PoCs on personal machines and the ability to scale the PoC to an enterprise level app.It can be expensive, especially the licensing costs. However, there is added value in what it can do, not just log aggregation.Splunk is a bit pricier, but the benefits and ROI are huge.It is a pretty high cost solution, but if your organization has the funds, it can bring many benefits.Personnel costs are saved by not having to involve the domain developers from multiple teams when tracing a problem that spans multiple platforms.Truly evaluate the data you want to ingest and go slow. Pulling in data that can provide no use to your mission only wastes data against your license.

Read more »

Information Not Available
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
301,063 professionals have used our research since 2012.
Answers from the Community
Rhea Rapps
Darius RadfordUser

As all consultants say...it depends.
The elements I would factor in are:
1) How they are staffed?
2) What groups outside of security will use this tool?
3) Is this for SIEM or log management?
4) Size of environment

For" how are they staffed" question I think if you have developers and scripting expertise in house then this makes for a strong case for Splunk. If not then Q-Radar may be a better fit.

The next question..."what groups outside the security group with use this tool?". Splunk does a lot of items that are really nice to haves, but don't necessarily fall into the security space. So if folks outside of security team will use the tool and subsequently help fund the endeavor this makes a strong case for Splunk. If this is a pure play security need, then out of the box, I feel this is a strong case for Q-Radar

Is this for SIEM or log management? By default Splunk is not a SIEM, once you buy the SIEM/Security license then it becomes a SIEM. That being said, it does log management and analytics very well. Out of the box Q-Radar is a very effective SIEM with tons of pre-set rules. So obviously if this is a pure play log management move, then Splunk becomes a strong choice here.

Size of environment. Because the Splunk licensing model is based on the number of events being produced in your environment, then this is a factor that must be considered. Q-Radar on the other hand is one of most straight-forward SIEM installations, and shortest time to value out there. As such, they have often been associated with small to mid sized organizations.

There are other factors out there to consider...this is in no means an all encompassing list, however, I feel if you ask yourself these questions, at a minimum , then your answers becomes a lot clearer.

13 February 18
Loren BuhleUser

It depends on the intended purpose of the tool and the type of people implementing it. Q-Radar tends to focus its out-of-the-box reports on compliance reporting, as well as tracking behavior-based tracking that is arduous for the DIY script writer. Having used both, they are both great platforms that take quite a bit of training to fully understand and wring the most value. Once you are at a steady state of log analysis, Q-Radar tends to be more useful on exploring "what we don't know" while Splunk tends to focus on confirming what I suspected, but didn't have the evidence.

If you love scripting and going after known deviations, there are alot of Splunk consultants and expertise for hire. This makes Splunk slightly better for small organizations. If known deviations are "table stakes" and you focus is on exploring risks currently unknown to you...then Q-Radar is the better option, in my opinion. Q-Radar's learning curve used to be slightly steeper than Splunk...but I've heard there is more automation and better training on the Q-Radar in the past few years.

13 February 18
Eduardo PerezReal User

I had been looking at the Security Analytics Platforms from the top right quadrant in the Gartner and Forrester reports and found that [architectural] use-case really matters.

For my business I was looking to build a shared environment that would service multiple customers so multi-tenancy, data security, roles based access controls and self-service-ability were key requirements. For the purposes of providing the SOC a single-pane of glass I needed a single configurable dash, and in a single-tenant environment both (Splunk and QRadar) could do it but in a multi-tenanted scenario on one could do it, at least without having to adding unnecessary systems.

Also, I didn't want to spend too much time on integration, setup and configuration so having [SIEM] use cases and compliance reporting available out-of-the-box and integration with common devices and OS had to be part of the base offering allowing the team to install and start using it immediately.

For me QRadar ticked all the boxes. Additionally the vast range of free apps which include user behavioral analytics are available which let you leverage its analytics engine.

That said, Splunk is an effective analytics platform that has use cases outside of SecOps. You will need to have the depth of certified knowledge, expertise and deep pockets to make effective use.

14 February 18
SrSecAnalyst918Real User

We have always used IBM QRadar so I guess I am partial to that solution. I have researched Splunk, LogRhythm, Alien Vault, etc but we just have never made that transition. I am uncertain about Splunk reporting but I agree with Tim in that QRadar does offer extensive compliance-related reporting. I would also add that IBM has done a lot in the past few years to open up their API to partners to allow for a greater interoperability between multiple tools. So the integration between multiple tools is getting better. Unfortunately for us most of those tools are not used in our environment.

13 February 18
it_user128883User

First of all, I'm a Splunker (by religion, not by employment :)), which makes my opinion a bit subjective.

It really depends on what are you expecting from the solution and how skilled and how ready for new approaches you are.

QRadar is great as a pure SIEM solution. Easy to use, super integrated with common devices, fantastic correlations and reports, everything expected from a top SIEM solution.

Splunk, on the other hand, offers much more. Splunk is more a general purpose big-data collecting platform, used to search and find anything very quickly and correlate any data, without prior knowledge of the data structure. SIEM is just one purpose to use Splunk, often better suited and equipped than competitive SIEM solutions, because it always uses ALL data, not just the normalized ones. However, a newbie to Splunk might find the search-oriented GUI and more advanced approach than competitors rather confusing. Believe me, once you get used to the philosophy of Splunk and get familiar with its usage, there is no way back to any other tool.

19 March 18
Ranking
Views
47,409
Comparisons
26,044
Reviews
52
Followers
2,123
Avg. Rating
8.4
Views
108,210
Comparisons
67,713
Reviews
49
Followers
2,724
Avg. Rating
8.8
Views
0
Comparisons
0
Reviews
1
Followers
1
Avg. Rating
5.0
Top Comparisons
Compared 48% of the time.
Compared 11% of the time.
Compared 11% of the time.
See more IBM QRadar competitors »
Compared 19% of the time.
Compared 13% of the time.
Compared 8% of the time.
See more Splunk competitors »
Also Known As
QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar
Website/Video
IBM
Splunk
Null Vendor
Overview

The IBM QRadar security and analytics platform is a lead offering in IBM Security's portfolio. This family of products provides consolidated flexible architecture for security teams to quickly adopt log management, SIEM, user behavior analytics, incident forensics, and threat intelligence and more. As an integrated analytics platform, QRadar streamlines critical capabilities into a common workflow, with tools such as the IBM Security App Exchange ecosystem and Watson for Cyber Security cognitive capability.

With QRadar, you can decrease your overall cost of ownership with an improved detection of threats and enjoy the flexibility of on-premise or cloud deployment, and optional managed security monitoring services.

Splunk software has been around since 2006 and the company has since grown to become an industry leader. Splunk's vision is to make machine data accessible, usable and valuable to everybody. The company offers a wide range of products to turn machine data into valuable information by monitoring and analyzing all activities. This is known as Operational Intelligence and is the unique value proposition of Splunk.

Splunk is well-known for its Log Management capabilities and also for its Security Information and Event Management (SIEM) solutions.

Information Not Available
OFFER
Learn more about IBM QRadar
Learn more about Splunk
Learn more about Null Product
Sample Customers
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.
Information Not Available
Top Industries
REVIEWERS
Financial Services Firm
25%
Transportation Company
18%
Comms Service Provider
7%
Health, Wellness And Fitness Company
7%
VISITORS READING REVIEWS
Financial Services Firm
20%
Comms Service Provider
13%
University
6%
Healthcare Company
6%
REVIEWERS
Financial Services Firm
20%
Retailer
14%
Energy/Utilities Company
14%
University
9%
VISITORS READING REVIEWS
Financial Services Firm
17%
Comms Service Provider
10%
Energy/Utilities Company
7%
Manufacturing Company
6%
No Data Available
Company Size
REVIEWERS
Small Business
30%
Midsize Enterprise
13%
Large Enterprise
58%
VISITORS READING REVIEWS
Small Business
25%
Midsize Enterprise
19%
Large Enterprise
57%
REVIEWERS
Small Business
21%
Midsize Enterprise
13%
Large Enterprise
67%
VISITORS READING REVIEWS
Small Business
14%
Midsize Enterprise
19%
Large Enterprise
67%
No Data Available
Find out what your peers are saying about IBM QRadar vs. Splunk and others in Security Information and Event Management (SIEM).
Download now
301,063 professionals have used our research since 2012.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.

Sign Up with Email