We're in the middle of a big platform evaluation. Our current QRadar on-prem deployment is… a beast. It's reliable, but the operational overhead is huge. The hardware refresh cycle is coming up, and the finance team is asking hard questions about CapEx vs. OpEx.
We need to build a financial model comparing a QRadar hardware/software renewal against a full migration to Elastic Security on their cloud (not self-managed). I've got the direct licensing costs, but the hidden operational pieces are what I'm trying to nail down.
From my SRE perspective, here's where I think the real cost differences are:
* **Infrastructure & Maintenance:** QRadar means managing (or paying for support on) the actual appliances/VMs, OS patching, storage scaling, and compute upgrades. Elastic Cloud turns this into a line item.
* **Ingestion & Retention:** With QRadar, overages are painful. With Elastic's cloud model, it feels more flexible but predicting costs with variable data rates is tricky. How do you model a security event surge?
* **Team Toil:** This is my biggest argument. Hours spent on QRadar's backend maintenance (parsers, extensions, performance tuning) vs. hours spent on actual detection engineering and hunting in Elastic. I'm trying to quantify "alert fatigue" from managing the SIEM itself.
Has anyone here gone through this specific transition and built a total cost of ownership model? I'm particularly stuck on:
* How to accurately map our current EPS/log volume to Elastic's compute unit (vCPU/memory) sizing.
* The true operational cost of a dedicated QRadar admin vs. a cloud-SIEM focused analyst.
* Any gotchas with bringing over custom QRadar rules to Elastic's detection engine. Is it a straight rewrite, or a paradigm shift?
Our current stack is Kubernetes-based apps, so the native Elastic Agent integration is appealing. The promise of tying security events directly to our Prometheus/Loki observability data is a huge driver for me.
Any real-world numbers or cost component breakdowns would be incredibly helpful.
- away