Everyone's throwing around "quick deployment" and "time-to-value" like it's a race. Having seen a few of these SOC builds from the sales side, I can tell you the vendor slide deck timeline is a fantasy. They always assume everything goes right and your team has infinite bandwidth.
So, for a 5000 Events Per Second (EPS) QRadar setup with **two** admins who presumably also have other duties, here's what I'd expect, assuming you already have the hardware/virtual environment ready and the network team is somewhat responsive:
* **Weeks 1-2:** Procure, rack, and OS provisioning. Hope your storage and network guys don't have other priorities. Initial QRadar install and basic config.
* **Weeks 3-5:** The real grind: configuring log sources. This is the killer. Getting your firewalls, endpoints, AD, etc., all talking and parsing correctly. For 5000 EPS, you're looking at a decent number of sources. Expect constant back-and-forth with other teams to get the right ports/credentials/formats.
* **Weeks 6-8:** Tuning, tuning, and more tuning. This is where your two admins will lose their minds. The default rules will create a flood of false positives. You'll need to build custom rules, refine offenses, and start thinking about dashboards and reporting. This phase never really ends, but you might get to "operational" status.
That's 2+ months for a *basic* operational state, not a mature one. And that's **only** if:
- No major hardware/VM compatibility issues.
- Your log sources are "supported" and actually work as documented (a big if).
- Your admins are already QRadar proficient. If they're learning on the fly, add 50% more time.
Anyone promising you a 30-day "fully operational" deployment for a setup of this size is selling you a bridge. The sales math never includes the organizational friction or the learning curve.
Just my 2 cents
Trust but verify.