Try our new research platform with insights from 80,000+ expert users

CrowdStrike Observability vs IBM Security QRadar comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Apr 6, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

CrowdStrike Observability
Ranking in Log Management
41st
Average Rating
8.4
Reviews Sentiment
6.1
Number of Reviews
3
Ranking in other categories
No ranking in other categories
IBM Security QRadar
Ranking in Log Management
6th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
209
Ranking in other categories
Security Information and Event Management (SIEM) (4th), User Entity Behavior Analytics (UEBA) (1st), Endpoint Detection and Response (EDR) (17th), Security Orchestration Automation and Response (SOAR) (4th), Managed Detection and Response (MDR) (9th), Extended Detection and Response (XDR) (10th)
 

Mindshare comparison

As of May 2025, in the Log Management category, the mindshare of CrowdStrike Observability is 0.5%, down from 0.6% compared to the previous year. The mindshare of IBM Security QRadar is 3.7%, down from 5.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management
 

Featured Reviews

ManelAlvarez - PeerSpot reviewer
Protection improves through superior global visibility and robust cloud integration
CrowdStrike Observability is especially useful when using a multi-cloud environment. Although it is expensive, the protection level it provides justifies the price. For users on Google Cloud, I prefer using Google's GTI technology. Overall, I would rate CrowdStrike Observability as nine out of ten. I rate the overall solution as nine.
Md. Shahriar Hussain - PeerSpot reviewer
Real-time incident detection and user-friendly dashboard benefit daily operations
There are many types of AI, and this AI is very limited in SQL and features. There may be potential for improvement. So far, it seems very limited. It shows some good features in the correlation part, but I think there is room for improvement. For instance, when creating rules, it can suggest more rules, reducing the effort needed. If AI-related support can suggest rules and integrate with existing security devices like MD, IPS, this SIM can create more relevant rules. Sometimes logs I receive don't mean anything, and I need technical stakeholders to share or forward logs, but these are sometimes inadequate. Keywords can help identify insufficient logs. I often lack time to verify logs. Sharing false positive results could be reduced to help my team.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The log aggregation and correlation of data are notable features that enhance our operations."
"The intelligence database provided by CrowdStrike is very impressive."
"I find the most effective feature of CrowdStrike Observability to be its cloud vision and attack surface vision, which enhance network traffic analysis."
"The intelligence database provided by CrowdStrike is very impressive."
"The price is worth it."
"The solution can scale."
"It integrates very easily with other solutions. The solution is flexible. We can add anything to it, as it is a good companion to other tools."
"The most valuable aspect of the solution is the integration capabilities on offer."
"The feature that I find the most useful is that IBM QRadar User Behavior Analytics is free of charge. It's a fully free product that can be installed on top of IBM QRadar SIEM."
"My overall rating for this solution is nine out of ten."
"I have found its network traffic log, network bit log, and QBI most valuable."
"The initial setup of QRadar is not complex because we have done it before and we are used to the development. It is getting easier all the time."
"It's user-friendly when compared to other products."
 

Cons

"The customer service is not satisfactory for me. The support is only available in English, and my users in LATAM regions such as Peru and Colombia require local language support, which is not currently provided."
"For reporting or log management, having a longer duration for backup without needing to purchase a paid subscription would be beneficial. Currently, there is a default ninety-day backup period."
"For reporting or log management, having a longer duration for backup without needing to purchase a paid subscription would be beneficial."
"Integration with Huawei should be more straightforward."
"Integration with Huawei should be more straightforward."
"There should be more opportunity for community kind of distribution where, for example, if there was a zero-day threat targeting companies."
"I don't give it a 10 because it is something we have to request. I would love it if UBA was included out of the box like Microsoft."
"The custom rules could be simplified more or it should be possible to use a different language, other than the ones that the solution is already using. They should add other languages into the mix."
"There are reports that I would like to generate that are either not included, or I cannot find."
"It needs more resilience and functionality."
"IBM technical support is always terrible."
"What needs to be improved in IBM QRadar User Behavior Analytics is the user experience. It's not optimal. Some screens are a bit clunky. The solution needs to be more user-friendly."
"The solution should include remote action capabilities."
 

Pricing and Cost Advice

Information not available
"There are additional costs, such as the cost associated with the different hardware required for implementation and deployment. Along with the add-on apps, these are all additional costs, and they require licensing as well."
"We use QRadar as a managed service and we pay licensing fees to the partner."
"Our licensing costs for this solution is on a yearly basis."
"They can give us some scalability and flexibility on pricing. If its pricing can be reduced, it would help a lot of customers in bringing in a new SIEM environment and grow business in the market. If I start a license today and take around 10,000 EPS, and after a month, there is an increase in the number of clients on my platform, I can increase the number of licenses. I can add 5,000 EPS on a yearly basis."
"It's too expensive. The licensing is also a little bit difficult to understand because you have to license it per event and per number of flows."
"The product is expensive. We have purchased the perpetual license, but we pay for the support."
"There are different types of subscriptions available. We were on an annual subscription, but our customers typically choose the two years subscription option."
"It is a perpetual license that we have for the event collector. The licensing is done based on the number of events and flows that you receive on this particular device. These are perpetual licenses, which means once you purchase them, they don't expire, which means that the support to IBM is definitely renewed after every one year. We have an enterprise agreement with IBM, which puts the cost in a totally different category as compared to someone who is not an IBM partner and is approaching IBM for this solution. We were able to get massive discounts. To give you an idea, we recently purchased 30,000 event licenses, and it costs around $480,000. It is definitely not a cheap product. We have licenses for about 270,000 events per second and 3 million flows per second. All the appliances and their events and flows are basically clubbed together and charged or rather calculated through a single source. The console receives all the details from all the event processes that we have globally. So, the license that we have is a single license for 270,000 events per second and 3 million flows per second, but that can be managed centrally. I was only part of the secondary purchase, which was 30,000 events per second for about $480,000. You can calculate how much we paid for 270,000 events. Reducing its price would be a compromise. We have already used a lower-priced product in the form of NNT, but we had to get rid of it because it was not doing the job that we actually wanted to do. You get what you pay for."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
851,604 professionals have used our research since 2012.
 

Comparison Review

VS
Jun 28, 2015
Qradar vs. ArcSight
Continuing with the SIEM posts we have done at Infosecnirvana, this post is a Head to head comparison of the two Industry leading SIEM products in the market – HP ArcSight and IBM QRadar Both the products have consistently been in the Gartner Leaders Quadrant. Both HP and IBM took over niche SIEM…
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Financial Services Firm
16%
Healthcare Company
7%
Manufacturing Company
7%
Educational Organization
23%
Computer Software Company
14%
Financial Services Firm
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What needs improvement with CrowdStrike Observability?
CrowdStrike Observability could improve in terms of understanding the functionality of different modules. The complexity of having multiple modules such as vulnerability management and identity man...
What is your primary use case for CrowdStrike Observability?
I have been using CrowdStrike Observability for the past two months with a focus on the cloud environment, specifically integrating with Google Cloud. We are currently utilizing it for detection pu...
What advice do you have for others considering CrowdStrike Observability?
CrowdStrike Observability is especially useful when using a multi-cloud environment. Although it is expensive, the protection level it provides justifies the price. For users on Google Cloud, I pre...
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendlier GUI and are not licensed based on capacity (amount of logs and information in...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
 

Also Known As

No data available
IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, IBM QRadar Advisor with Watson
 

Overview

 

Sample Customers

Information Not Available
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.
Find out what your peers are saying about CrowdStrike Observability vs. IBM Security QRadar and other solutions. Updated: April 2025.
851,604 professionals have used our research since 2012.