IBM QRadar

QRadar is IBM's security information and event management platform, positioned around unleashing analyst potential and outpacing adversaries through speed, scale and accuracy. Framing the product around the analyst rather than the technology is the right emphasis for this category.

The constraint in a security operations centre is human attention, not detection capability. A platform can generate any number of alerts, and the number it generates beyond what the team can investigate is worse than useless, because it buries the real detections and teaches analysts that alerts do not warrant urgency.

Correlation is the mechanism that addresses this and it is what distinguishes a SIEM from a log store. Twenty related events across a firewall, an endpoint and an authentication system are one incident, and presenting them as one item with the sequence assembled is the difference between a manageable queue and an unmanageable one.

IBM's position brings both advantages and the usual caveats. The company has decades of security research, a global services organisation and integrations with nearly everything, while a buyer should establish which QRadar deployment option a quote covers, since the product exists as software, appliance and cloud service with meaningfully different operating implications.

No pricing is published, which is normal here. Deployments are scoped by events per second and data volume, and the licensing model is worth understanding in detail before committing.