CylanceENDPOINT vs. QRadar SIEM: Which is Best?

This cybersecurity solution is excellent, in my opinion. It offers thorough coverage for a range of operating systems and is simple to install and maintain across a big network of devices. A significant benefit is the simplicity with which whitelists can be established up and mass quarantined. Reporting on and keeping an eye on malware families and threat patterns is made simple by the intuitive console. But occasionally, the script module might generate false positives, and if you're not careful, handling exceptions can be challenging. Real-time sandbox features are something else I would want to see included in the product.

Easy to deploy and manage policies, has coverage for various OS platforms, bulk quarantine across all hosts for a known threat and user friendly console for reporting

No real-time sandbox capabilities and false positive for the script module and could get tricky

n/a

CylanceProtect has consistently been regarded as the top choice for endpoint protection in the market. It offers exceptional security for both Windows and Mac endpoints, delivering outstanding protection.

However, since its acquisition by Blackberry in 2019, the integration of the two companies has been somewhat clumsy. While the Cylance website dashboard was clean and user-friendly, the Blackberry website design feels outdated. Additionally, there have been delays in releasing the endpoint client for Mac OS Big Sur, which should have been available earlier with Catalina. The frequent false positives for Adobe CS updates have also been a source of frustration. As our licensing is set to expire next summer, I will be exploring alternative options

QRadar effectively addresses the need to monitor, investigate, detect, and respond to threats on devices and endpoints within the environment. Its logs retention capability is commendable, and it efficiently collates and analyzes large amounts of data from both cloud and on-site sources, providing valuable insights for security operations.

One of the best aspects of QRadar is its ability to assist in threat detection and response, providing a comprehensive solution for remediating threats. Its open architecture allows for deployment on various platforms, including on-premises, cloud, or as a service. The integration capabilities with EDR, SIEM, SOAR, and other threat intelligence tools enable a unified and comprehensive XDR approach.

There are a few areas that could be improved. The EPS cap, which limits the number of logs that can be integrated into QRadar, can sometimes result in generating false positives. Additionally, the user-friendliness of the platform could be enhanced, especially in terms of setting rules, which can be a bit challenging.

IBM QRadar serves as a valuable SIEM tool that enhances the portfolio of offerings, especially when used alongside MDR services. It provides valuable insights into the latest cyber threats and offers various log types for the monitoring team, benefiting the overall security and threat detection capabilities.

The integration of threat intelligence feeds with QRadar is outstanding, providing valuable and insightful information. Additionally, the graphical user interface (GUI) of the tool is impressive and well-designed, catering to the needs of analysts.

One drawback of QRadar is its high license cost, which can be expensive for organizations. Additionally, customization requests and configuring specific use cases incur additional charges. Another aspect that could be improved is the response time of the support team, as they tend to take longer to address queries or issues.