IBM Security QRadar SIEM vs. Splunk Enterprise Security

IBM Security QRadar SIEM

284 Reviews and Ratings

Splunk Enterprise Security

253 Reviews and Ratings

Overview
Product	Rating	Most Used By	Product Summary	Starting Price
IBM Security QRadar SIEM	Score9 out of 10	N/A	IBM Security QRadar is security information and event management (SIEM) Software.	N/A
Splunk Enterprise Security	Score9.7 out of 10	N/A	Splunk Enterprise Security is an analytics-driven SIEM that helps to combat threats with actionable intelligence and advanced analytics at scale.	N/A

Pricing

IBM Security QRadar SIEM

Splunk Enterprise Security

No answers on this topic

No answers on this topic

Pricing Offerings
IBM Security QRadar SIEM	Splunk Enterprise Security
Free Trial
Yes	No
Free/Freemium Version
No	No
Premium Consulting/Integration Services
No	No

No setup fee

No setup fee

—

—

Community Pulse
Key User Insights
	IBM Security QRadar SIEM	Splunk Enterprise Security
Considered Both Products	IBM Verified User Chose IBM Security QRadar SIEM I would always recommend Splunk over IBM Security QRadar SIEM unless you're trying to save money or only onboarding and normalizing well known data sources. IBM Security QRadar SIEM doesn't seem to handle RBA and complicated, chaining correlation rules very effectively and if I … Incentivized Helpful? Verified User Chose IBM Security QRadar SIEM We chose IBM Security QRadar SIEM not only because it was a leader but because it convinced us it was a solid product suitable for multiple scenarios but most importantly we needed a really secure and powerful software for our infrastructure. Incentivized Helpful? Verified User Chose IBM Security QRadar SIEM Because they are the best and most used tools in the Cyber Security market for event correlation. Incentivized Helpful? Verified User Chose IBM Security QRadar SIEM IBM Qradar is cheaper and also easy to use. For splunk you need dedicated team of experts. Incentivized Helpful? Verified User Chose IBM Security QRadar SIEM As a part of core security service provider, we could not stand with the tools that are used as a generic data processor. The compliance, log reading and events are well managed in QRadar compared to other tools Incentivized Helpful? ısa baser Security Engineer in Information Technology at BGA Cyber Security (Computer & Network Security, 51-200 employees) Chose IBM Security QRadar SIEM roi (return of investment) is better for Qradar SIEM. Incentivized Helpful? Muhammed Ali CETİN Information Technology Security Engineer in Information Technology at Yapı Kredi Teknoloji (Banking, 10,001+ employees) Chose IBM Security QRadar SIEM IBM is more user-friendly if we compare it with ELK stack and ArcSight. Much reliable, and have better Support. Onboarding data, creating correlation searches, and easier to integrate with 3rd party solutions as well. LogOps projects and less time-consuming products. Qradar … Incentivized Helpful? Muhannad Zarour Senior Cybersecurity Consultant/Trainer in Information Technology at IT Security C&T (Information Technology & Services, 11-50 employees) Chose IBM Security QRadar SIEM Very close competition but IBM QRadar stands out; other IBM products support the cybersecurity monitoring and IR function. Incentivized Helpful? Verified User Chose IBM Security QRadar SIEM User friendly interface and easy to install and implementation. A lots of Log source types ( more than 400) and DSM Editor with standard regexp. Demo version IBM Qradar CE help to practice and learn how it's work and allow you to test scripts before applying them on deployment … Incentivized Helpful?	Cisco Verified User Chose Splunk Enterprise Security Splunk enterprise is the only solution that we’ve been able to identify that provides risk based alerting, which allows our SOC to reduce analyst fatigue which would be a huge problem without it. Before RBA, there were thousands of alerts a day and it was impossible to review … Incentivized Helpful? Verified User Chose Splunk Enterprise Security - Schema on the fly indexing --> Gives you faster index searches. Even if you use Datamodes, it's 100x time faster as well. - Correlation with other domains easily gives you total visibility and reduces the time to investigate and understand the problem. - With lookups and trust, … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Securonix does not nearly meet the scale, extensibility, and maturity that Splunk ES offers. However, when looking at the MSP architecture options, Securonix is a much more flexible platform for multi-tenanting. So, Splunk ES for captive SOC platforms and Securonix for … Incentivized Helpful? Saibal Banerjee Cyber Security Consultant in Professional Services at Tata Consultancy Services (Information Technology & Services, 10,001+ employees) Chose Splunk Enterprise Security Splunk ES is by far the best solution in the market as per flexibility, features and support. Cost-wise, it is the most expensive option to go with, but that has its own advantages as the product that we get is premium and superior to other SIEM. The best thing about Spunk ES … Incentivized Helpful? Jacob Gonzales IDS/SIEM Engineering Supervisor in Information Technology at Criterion Systems (Information Technology & Services, 1001-5000 employees) Chose Splunk Enterprise Security Splunk Enterprise Security allows for data normalization that does not compare to other SIEMs such as QRadar or Trustwave. QRadar requires custom dsm parsers before the data can be onboarded. I appreciate that Splunk Enterprise Security can ingest any source of data and … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Splunk does not hide its correlation and analytics logic from users as much as other solutions in the same space. While some features are harder to access the underlying information is all accessible and tunable. This gives Splunk an edge over other solutions that lock the … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Qradar is easy for first-timers. Easy to deploy and manage but if you need an advanced solution for ML, Anomaly Detection you need to use Splunk. Qradar is solid, too. But Splunk has advanced functionality for detection and automation. Incentivized Helpful? Kelvin Goh Security Consultant in Information Technology at Mesiniaga Berhad (1001-5000 employees) Chose Splunk Enterprise Security Splunk Enterprise Security is well designed and provide many comprehensive features which able to protect and monitor the organization. The features are well being used and does not cause any performance issue. Overall the solution is quite stable. Technical support from Splunk … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Apart from ES I have used Dynatrace and Qradar SIEM tool to work on security findings in organization where in Dynatrace with the help of collector agent we can monitor proper host data and it can be further classified in host process, memory usage, cpu usage etc as per Qradar … Incentivized Helpful? Verified User Chose Splunk Enterprise Security As Sumo Logic and QRadar are the same SIEM Tool, the reason for selecting Splunk Enterprise Security above those was Splunk Enterprise Security is more handy than these two. The SPL query we write to get more effective results to create Alerts, Reports, and Dashboards are more … Incentivized Helpful? Verified User Chose Splunk Enterprise Security Better searching and more options for plugins Incentivized Helpful? ranjit abraham Programmer Analyst in Information Technology at Aliado solutions (Computer & Network Security, 11-50 employees) Chose Splunk Enterprise Security I personally felt that It is easier to onboard structured data to IBM radar compared to Splunk. But when onboarding unstructured data or unknown data Splunk is king. Incentivized Helpful? Phótis Deligiánnis Cyber Security Engineer in Information Technology at SIX (Financial Services, 1001-5000 employees) Chose Splunk Enterprise Security Difficult to choose, each one has pros and cons. Splunk has the best interface, QRadar has strong capabilities but ES is free. Incentivized Helpful? Himanshu Porwal Engagement Director at TCS (Computer Software, 5001-10,000 employees) Chose Splunk Enterprise Security Splunk Enterprise Security is much more flexible and effective. Incentivized Helpful? Michael Simko Principal Architect in Information Technology at Kinney Group (Information Technology & Services, 51-200 employees) Chose Splunk Enterprise Security Flexibility, the power of the search language, the amount of premade content put ES above. Incentivized Helpful? Allan Crittenden Edwards Security Analyst in Information Technology at Eastern Michigan University (Higher Education, 1001-5000 employees) Chose Splunk Enterprise Security We used QRadar a while ago. Perhaps it was just poorly configured but it provided almost no value. It seemed harder to tune for our environment if it was even possible. Also, they didn't value us as a customer. They tried to make us re-purchase the product when they acquired … Incentivized Helpful?
	Would buy again
	No answers on this topic	No answers on this topic
	Delivers good value for the price
	No answers on this topic	No answers on this topic
	Happy with the feature set
	No answers on this topic	No answers on this topic
	Lived up to sales and marketing promises
	No answers on this topic	No answers on this topic
	Implementation went as expected
No answers on this topic	No answers on this topic

Features

IBM Security QRadar SIEM

Splunk Enterprise Security

Comparison of Security Information and Event Management (SIEM) features of IBM Security QRadar SIEM and Splunk Enterprise Security
Feature	IBM Security QRadar SIEM 8.5 69 Ratings	Splunk Enterprise Security 8.4 102 Ratings
Centralized event and log data collection	9.927 Ratings	9.3100 Ratings
Correlation	8.669 Ratings	8.699 Ratings
Event and log normalization/management	9.527 Ratings	8.5100 Ratings
Deployment flexibility	7.827 Ratings	8.3101 Ratings
Integration with Identity and Access Management Tools	8.965 Ratings	7.896 Ratings
Custom dashboards and workspaces	7.569 Ratings	9.2102 Ratings
Host and network-based intrusion detection	9.725 Ratings	7.996 Ratings
Data integration/API management	9.07 Ratings	8.498 Ratings
Behavioral analytics and baselining	7.648 Ratings	7.795 Ratings
Rules-based and algorithmic detection thresholds	8.049 Ratings	8.596 Ratings
Response orchestration and automation	7.75 Ratings	7.087 Ratings
Reporting and compliance management	7.947 Ratings	8.695 Ratings
Incident indexing/searching	8.97 Ratings	9.2101 Ratings

User Ratings
	IBM Security QRadar SIEM	Splunk Enterprise Security
Likelihood to Recommend	8.4 (89 ratings)	8.9 (103 ratings)
Likelihood to Renew	7.3 (4 ratings)	9.0 (3 ratings)
Usability	9.1 (1 ratings)	7.5 (2 ratings)
Availability	- (0 ratings)	9.1 (1 ratings)
Performance	- (0 ratings)	8.2 (1 ratings)
Support Rating	8.1 (62 ratings)	6.6 (6 ratings)
In-Person Training	- (0 ratings)	9.1 (1 ratings)
Online Training	- (0 ratings)	8.2 (1 ratings)
Implementation Rating	- (0 ratings)	9.1 (1 ratings)
Configurability	- (0 ratings)	7.3 (1 ratings)
Contract Terms and Pricing Model	- (0 ratings)	7.3 (1 ratings)
Ease of integration	8.1 (58 ratings)	6.4 (1 ratings)
Product Scalability	- (0 ratings)	9.3 (100 ratings)
Professional Services	- (0 ratings)	9.1 (1 ratings)
Vendor post-sale	- (0 ratings)	8.2 (1 ratings)
Vendor pre-sale	- (0 ratings)	8.2 (1 ratings)