We just raised a $30M Series A: Read our story

Compare IBM QRadar vs. Oracle Security Monitoring and Analytics Cloud Service

Cancel
You must select at least 2 products to compare!
Featured Review
Find out what your peers are saying about Splunk, IBM, Devo and others in Security Information and Event Management (SIEM). Updated: October 2021.
552,305 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
"The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way.""In traditional BI solutions, you need to wait a lot of time to have the ability to create visualizations with the data and to do searches. With this kind of platform, you have that information in real-time.""Those 400 days of hot data mean that people can look for trends and at what happened in the past. And they can not only do so from a security point of view, but even for operational use cases. In the past, our operational norm was to keep live data for only 30 days. Our users were constantly asking us for at least 90 days, and we really couldn't even do that. That's one reason that having 400 days of live data is pretty huge. As our users start to use it and adopt this system, we expect people to be able to do those long-term analytics.""The real-time analytics of security-related data are super. There are a lot of data feeds going into it and it's very quick at pulling up and correlating the data and showing you what's going on in your infrastructure. It's fast. The way that their architecture and technology works, they've really focused on the speed of query results and making sure that we can do what we need to do quickly. Devo is pulling back information in a fast fashion, based on real-time events.""The ability to have high performance, high-speed search capability is incredibly important for us. When it comes to doing security analysis, you don't want to be doing is sitting around waiting to get data back while an attacker is sitting on a network, actively attacking it. You need to be able to answer questions quickly. If I see an indicator of attack, I need to be able to rapidly pivot and find data, then analyze it and find more data to answer more questions. You need to be able to do that quickly. If I'm sitting around just waiting to get my first response, then it ends up moving too slow to keep up with the attacker. Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events.""The most valuable feature is definitely the ability that Devo has to ingest data. From the previous SIEM that I came from and helped my company administer, it really was the type of system where data was parsed on ingest. This meant that if you didn't build the parser efficiently or correctly, sometimes that would bring the system to its knees. You'd have a backlog of processing the logs as it was ingesting them.""It's very, very versatile.""The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable."

More Devo Pros »

"I have found IBM QRadar to be stable.""It is suitable for large companies with critical infrastructure. For our clients, robustness, availability at a high level, and the level of references and experiences connected to the solution are important.""The features that I have found most valuable in QRadar are its data enrichment, use case creations, and adding references - those kinds of features are very good. Also QRadar's event filtration and device integration are perfect.""The detection rate is good and the false positive rate is low.""One of the most valuable features of this solution is it has very good data correlation.""The solution is flexible and easy to use.""The most valuable features are log monitoring, easy-to-fix issues, and problem-solving.""It is a bit easier to use than other products, such as Splunk or ELK Elasticsearch."

More IBM QRadar Pros »

"The security level that they are maintaining with the pre-authentication keys is very good."

More Oracle Security Monitoring and Analytics Cloud Service Pros »

Cons
"Some third-parties don't have specific API connectors built, so we had to work with Devo to get the logs and parse the data using custom parsers, rather than an out-of-the-box solution.""The Activeboards feature is not as mature regarding the look and feel. Its functionality is mature, but the look and feel is not there. For example, if you have some data sets and are trying to get some graphics, you cannot change anything. There's just one format for the graphics. You cannot change the size of the font, the font itself, etc.""From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments.""There's always room to reduce the learning curve over how to deal with events and machine data. They could make the machine data simpler.""Technical support could be better.""One major area for improvement for Devo... is to provide more capabilities around pre-built monitoring. They're working on integrations with different types of systems, but that integration needs to go beyond just onboarding to the platform. It needs to include applications, out-of-the-box, that immediately help people to start monitoring their systems. Such applications would include dashboards and alerts, and then people could customize them for their own needs so that they aren't starting from a blank slate.""Their documentation could be better. They are growing quickly and need to have someone focused on tech writing to ensure that all the different updates, how to use them, and all the new features and functionality are properly documented.""Devo has a lot of cloud connectors, but they need to do a little bit of work there. They've got good integrations with the public cloud, but there are a lot of cloud SaaS systems that they still need to work with on integrations, such as Salesforce and other SaaS providers where we need to get access logs."

More Devo Cons »

"IBM is going through some problems with its resources currently making its support response time slow.""If you have too many events that occur, then the storage capacity becomes a problem. You need to have more storage.""There are a lot of things they are working on and a lot of technologies that are not yet there. They should probably work out a better reserve with their ecosystem of business partners and create wider and more in-depth qualities, third-party tools, and add-ons. These things really give immediate business value. For instance, there are many limitations in using SAP, EBS, or Micro-Dynamics. A lot of things that are happening in those platforms could also be monitored and allowed from the cybersecurity risks perspective. IBM might be leaving this gap or empty space for business partners. Some larger organizations might already be doing this. It would be very nice if IBM can make some artificial intelligence part free of charge for all current QRadar users. This would be a big advantage as compared to other competitors. There are companies that are going in different directions. Of course, you can't do everything inside QRadar. In general, it might be very good for all players to provide more use cases, especially regarding data protection and leakage prevention. There are some who are already doing some kind of file integrity or gathering some more information from all possible technologies for building anything related to the user and data analysis, content analysis, and management regarding the data protection.""The user interface is a bit difficult to get used to.""The whole process for support is something that needs to be improved.""We have had problems with networking.""The only challenge with products like IBM is the EPS. You just have to be really on the events per second, as that's where the cost factor becomes a huge issue.""The product needs to improve its GUI."

More IBM QRadar Cons »

"The solution could improve by providing better documentation for beginners to learn, such as videos or other tutorials."

More Oracle Security Monitoring and Analytics Cloud Service Cons »

Pricing and Cost Advice
"[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more.""Be cautious of metadata inclusion for log types in pricing, as there are some "gotchas" with that.""We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom.""Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products.""It's a per gigabyte cost for ingestion of data. For every gigabyte that you ingest, it's whatever you negotiated your price for. Compared to other contracts that we've had for cloud providers, it's significantly less.""Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs.""Our licensing fees are billed annually and per terabyte.""I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."

More Devo Pricing and Cost Advice »

"It is costlier as compared to the other alternatives available in the market.""The price could be better. I bought a subscription for three years.""IBM QRadar is a little bit expensive compared to other products.""This price is a little high, so it's an expensive product.""It is overly expensive and overly complex in terms of licensing. They have many different appliances, which makes it extremely difficult to choose the technology. It is very difficult to choose the technology or QRadar components that you should be deploying. They have improved some of it in the last few years. They have made it slightly easy with the fact that you can now buy virtual versions of all the appliances, which is good, but it is still very fragmented. For instance, on some of the smaller appliances, there is no upgrade path. So, if you exceed the capacity of the appliance, you have to buy a bigger appliance, which is not helpful because it is quite a major cost. If you want to add more disks to the system, they'll say that you can't.""It would be great if this product were cheaper.""It is a perpetual license that we have for the event collector. The licensing is done based on the number of events and flows that you receive on this particular device. These are perpetual licenses, which means once you purchase them, they don't expire, which means that the support to IBM is definitely renewed after every one year. We have an enterprise agreement with IBM, which puts the cost in a totally different category as compared to someone who is not an IBM partner and is approaching IBM for this solution. We were able to get massive discounts. To give you an idea, we recently purchased 30,000 event licenses, and it costs around $480,000. It is definitely not a cheap product. We have licenses for about 270,000 events per second and 3 million flows per second. All the appliances and their events and flows are basically clubbed together and charged or rather calculated through a single source. The console receives all the details from all the event processes that we have globally. So, the license that we have is a single license for 270,000 events per second and 3 million flows per second, but that can be managed centrally. I was only part of the secondary purchase, which was 30,000 events per second for about $480,000. You can calculate how much we paid for 270,000 events. Reducing its price would be a compromise. We have already used a lower-priced product in the form of NNT, but we had to get rid of it because it was not doing the job that we actually wanted to do. You get what you pay for.""There is a license required for this solution. There are some limitations depending on what license you purchase."

More IBM QRadar Pricing and Cost Advice »

"The solution is not expensive for the data security measure you receive, it is reasonable."

More Oracle Security Monitoring and Analytics Cloud Service Pricing and Cost Advice »

report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
552,305 professionals have used our research since 2012.
Questions from the Community
Top Answer: It's very, very versatile.
Top Answer: Devo, like other vendors, doesn't charge extra for playbooks and automation. That way, you are only paying for the side… more »
Top Answer: I need more empowerment in reporting. For example, when I'm using Qlik or Power BI in terms of reporting for the… more »
Top Answer: The product has plenty of features and capabilities.
Top Answer: The usability of interfaces could be improved and the solution could have better correlation services, as well as faster… more »
Top Answer: The security level that they are maintaining with the pre-authentication keys is very good.
Top Answer: The solution is not expensive for the data security measure you receive, it is reasonable.
Top Answer: The solution could improve by providing better documentation for beginners to learn, such as videos or other tutorials… more »
Comparisons
Also Known As
QRadar SIEM, QRadar UBA, QRadar on Cloud, QRadar
SMA Cloud Service
Learn More
Overview

Devo is the only cloud-native logging and security analytics platform that releases the full potential of all your data to empower bold, confident action when it matters most. Only the Devo platform delivers the powerful combination of real-time visibility, high-performance analytics, scalability, multitenancy, and low TCO crucial for monitoring and securing business operations as enterprises accelerate their shift to the cloud.

The IBM QRadar security and analytics platform is a lead offering in IBM Security's portfolio. This family of products provides consolidated flexible architecture for security teams to quickly adopt log management, SIEM, user behavior analytics, incident forensics, and threat intelligence and more. As an integrated analytics platform, QRadar streamlines critical capabilities into a common workflow, with tools such as the IBM Security App Exchange ecosystem and Watson for Cyber Security cognitive capability.

With QRadar, you can decrease your overall cost of ownership with an improved detection of threats and enjoy the flexibility of on-premise or cloud deployment, and optional managed security monitoring services.

Oracle Security Monitoring and Analytics (SMA) Cloud Service enables rapid detection, investigation and remediation of the broadest range of security threats across on-premises and cloud IT assets. Security Monitoring and Analytics provides integrated SIEM and UEBA capabilities built on machine learning, user session awareness, and up-to-date threat intelligence context. This service is built on Oracle Management Cloud's secure, unified big data platform.
Offer
See Devo in Action

See how Devo allows you to free yourself from data management, and make machine data and insights accessible.

Learn more about IBM QRadar
Learn more about Oracle Security Monitoring and Analytics Cloud Service
Sample Customers
United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.
Information Not Available
Top Industries
VISITORS READING REVIEWS
Computer Software Company28%
Comms Service Provider20%
Government8%
Financial Services Firm7%
REVIEWERS
Financial Services Firm21%
Comms Service Provider12%
Security Firm7%
Transportation Company7%
VISITORS READING REVIEWS
Computer Software Company29%
Comms Service Provider27%
Financial Services Firm6%
Government5%
VISITORS READING REVIEWS
Computer Software Company43%
Comms Service Provider16%
Government5%
Financial Services Firm4%
Company Size
REVIEWERS
Small Business17%
Midsize Enterprise17%
Large Enterprise67%
VISITORS READING REVIEWS
Small Business48%
Midsize Enterprise15%
Large Enterprise36%
REVIEWERS
Small Business40%
Midsize Enterprise18%
Large Enterprise42%
VISITORS READING REVIEWS
Small Business27%
Midsize Enterprise26%
Large Enterprise46%
No Data Available
Find out what your peers are saying about Splunk, IBM, Devo and others in Security Information and Event Management (SIEM). Updated: October 2021.
552,305 professionals have used our research since 2012.

IBM QRadar is ranked 2nd in Security Information and Event Management (SIEM) with 56 reviews while Oracle Security Monitoring and Analytics Cloud Service is ranked 31st in Security Information and Event Management (SIEM) with 1 review. IBM QRadar is rated 8.2, while Oracle Security Monitoring and Analytics Cloud Service is rated 7.0. The top reviewer of IBM QRadar writes "Provides a single window into your network, SIEM, network flows, and risk management of your assets". On the other hand, the top reviewer of Oracle Security Monitoring and Analytics Cloud Service writes " Easy to install, highly secure standards, and reliable". IBM QRadar is most compared with Splunk, LogRhythm NextGen SIEM, ELK Logstash, Microsoft Sentinel and ArcSight Enterprise Security Manager (ESM), whereas Oracle Security Monitoring and Analytics Cloud Service is most compared with LogRhythm NextGen SIEM, Microsoft Sentinel, Fortinet FortiSIEM, Exabeam Fusion SIEM and ArcSight Enterprise Security Manager (ESM).

See our list of best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.