I've been hearing the "cloud-first" drumbeat from IBM for a while now, but let's be honest: QRadar's soul is still on-prem, wearing a virtual machine's clothing. The marketing slicks make it sound seamless, but I'm deeply skeptical.
We're evaluating a cloud-only SIEM deployment, and QRadar on IBM Cloud (or AWS/Azure Marketplace) is on the shortlist. My procurement brain is already screaming about egress fees for logs and the true cost of those "managed" hosts. Everyone loves to talk about the shiny dashboard, but I want the gritty details from anyone actually living this.
Specifically:
* What's the real performance hit (and cost) of streaming all your cloud infra logs (CW, Azure Diagnostic, etc.) into QRadar's Event Collectors? The ingestion pricing model feels like a trap waiting to be sprung.
* How "cloud-native" is the orchestration? If I need to scale a console, am I filling out a ticket or is it an API call that doesn't require a PhD in QRadar architecture?
* Most importantly, the SLAs. IBM's for their cloud infra is one thing, but what's the actual mean time to recovery when a managed host decides to flake out? I've seen the support playbook: blame the customer's "unique" network configuration first.
I'm braced for the survivorship bias in the success stories. Give me the pitfalls, the hidden line items, and the "oh, we didn't think about that" moments.
Your free trial ends today.