IBM Instana vs. IBM Security QRadar SIEM

With enterprise IT assets in a multitude of ecosystems, cloud infrastructures and sometimes still left stuck in a legacy on prem architecture, IBM Instana makes it easy to get the right data to drive development and / or DevSecOps processes with tangible input from the target environment itself.

Incentivized

QRadar is very well suited on environments where there are not multiple tenants or domains, we do have success on this kind of scenario. IBM Security QRadar SIEM is less appropriate for environments with multiple tenants, specially when each tenant represent a different End Costumer (such as for MSSP companies), those environments require a high amount of rules and building blocks replications, since each tenant will have its own "BB definitions", servers, rules exception, etc. Also, some information, such as EPS count or EPS dropped are generated by QRadar's own log sources, which takes place on default domain, therefore users associated with different domain can not have access to those logs, even when the information is related to other domain's environment. For example, even if Event Collector 1 is associated to Domain A, the log informing its dropped EPS is generated by System notification, log source that must be associated to Default domain.

Incentivized

• Collecting Kubernetes and Infra level logs and presenting in easy to understand visuals.
• Tracing the end-to-end journey of an event and also categorizing by technology and Endpoints
• Built-in and custom alerts help to monitor almost all of scenarios without much additional configuration.
• Ability to create Applications to logical group important flows

Incentivized

• Enables identification and prioritization of vulnerabilities in IT infrastructure for corrective action.
• Facilitates security incident investigation and forensic analysis.
• Provides a real-time view of security events, enabling immediate incident response.
• Can integrate with external threat intelligence sources to enrich data and improve threat detection.
• Enables the generation of detailed and customized reports.

Incentivized

• I believe that the "live" option in monitoring does not truly update the status in real-time, thus I must manually update to feel comfortable.
• The call analysis tool might be improved, third-party resources are restricted, and the pricing is slightly more than competitors in comparable categories.

Incentivized

• Need to spend more time configuring the system to properly interpret and normalize different type of data collected from multiple resources.
• While Rule creation QRadar uses that rules to detect security threats and generate alerts, but to creating and managing rules is bit complex & tedious work to complete.
• IBM Security QRadar SIEM is excellent in handling large & complex systems that requires in-depth knowledge and extensive training to configure and maintain the system which includes upgrading, optimization of performance & issue troubleshooting.

Incentivized

Instana has been able to fulfill our all requirement and provide out of box solution for multiple component like AWS RDS Monitoring and real time alerting setup on basis of that. it is also easy to integrate with other open-source alerting and monitoring tools which makes it easier to incorporate into our solutions

Incentivized

With the arrival of IBM Security QRadar SIEM at our company, we have a better vision of all the security needs that may arise, it is a very safe software to use that prevents threats from damaging our IT environment, it is impossible to change it for another software.

Incentivized

IBM Instana totally alters our monitoring approach since it increases the stability of the system and simplifies the process of problem solving. And since it helps to lower the degree of alert exhaustion that we experience, it is a total game changer for us.

Incentivized

As a grade I give 8 as QRadar is not easy to learn. It requires some time to master it. It also needs a team of people actively working on the product. Once you learn to use it the software works very well and it is easy to correlate and understand detected threats. It only takes time to learn how to use it well and configure it properly.

Incentivized

IBM instana support team is good but when we ask them for support, they keep asking same thing again and again and mostly there is no solution

Incentivized

Customer support is Good of IBM, While Using IBM QRadar its deployment is to slow and suddenly stop working and crashed we have contacted IBM Support and Rised a Ticket within a few minute we get call back from customer support and Query Resolved by them Fast And Rapid Support of Ibm

Incentivized

The training was very useful and the people who taught us were very knowledgeable. Although the software may initially seem difficult to learn they made things much easier for us.

Incentivized

The training was very useful and the people who taught us were very knowledgeable. Although the software may initially seem difficult to learn they made things much easier for us.

Incentivized

Initial patience is required to learn how to use the product, and it takes a dedicated team to use it. One person is not enough, and it's not enough to just set it up and check it once in a while. It has to be used daily and kept under control to be used effectively

Incentivized

As a DevOps engineer, I've explored various Application Performance Monitoring (APM) tools, including New Relic for real-time insights, AppDynamics for code-level visibility, Dynatrace for AI-driven monitoring, Datadog for comprehensive observability, Splunk for log management, Stackify Retrace for error tracking, and Raygun for crash reporting. Each tool offers distinct features, and the choice depends on specific use cases, technology stacks, and organizational needs. Thorough evaluations, considering factors like ease of use, integration capabilities, and scalability, help in selecting the most suitable APM solution for effective application monitoring in a DevOps environment.

Incentivized

I would always recommend Splunk over IBM Security QRadar SIEM unless you're trying to save money or only onboarding and normalizing well known data sources. IBM Security QRadar SIEM doesn't seem to handle RBA and complicated, chaining correlation rules very effectively and if I had to write a custom add-on for custom data, I found it easier to do so in Splunk.

Incentivized

• Let's me monitor and pinpoint issues across multiple critical systems and applications that work in tandem, reducing drastically, the time in identifying root cause and solving the issues.
• Let's me deep dive into issues found with a lot of detailed information about particular requests , and find proper solutions by my own research or even with Gen AI assistant using Watson.x or you could prompt your AI solution of choice as well.
• All systems fail at some point, so IBM Instana gives stakeholders ease that large complex and critical systems that affect the very livelihood of people is being observed with pinpoint precision and that issues are addressed promptly and with compass pointing north towards the problem's root cause and solutions.

Incentivized

• Like any cybersecurity product, any money you don't lose on a prevented attack is money that you saved
• Most of the apps are free and provides great enrichment like User Behaviour Analytics
• Top quality alerts gives enormous value to the "passive" data that flows into the infrastructure

Incentivized