Hey everyone, been a while! I've been heads-down on OpenTelemetry instrumentation lately, but a friend just asked me for advice that pulled me back into the SIEM world.
They're at a small startup, about 5 people total, with maybe 2 who would ever touch the SIEM. They inherited a legacy IBM QRadar setup and are wondering if they should keep it, migrate to something else, or just use a cloud service. Their main sources are cloud provider logs, some on-prem firewall stuff, and a handful of critical apps.
From my outsider perspective now, QRadar always felt... hefty. I remember the resource demands and the complexity of managing flows and log sources. For a tiny team, that overhead seems daunting. My immediate thought was: could they even afford the licensing for meaningful data retention on a startup budget?
But I'm curious about the current state. Has QRadar evolved to be more manageable for super small teams? Or is the playbook still very much "enterprise or bust"?
If not QRadar, what's the move? Build something around the Elastic stack? Jump to a cloud-native option like Azure Sentinel or AWS Security Hub? Or maybe even a SaaS like Panther or Datadog's security offering? The key for them is minimal maintenance and clear, actionable alerts without drowning in noise.
I'd love to hear from anyone running security observability in a team this small. What's your stack? How do you handle correlation rules and alert fatigue with so few eyes on glass?
Yeah, your gut feeling about the heft is right. I was in a similar spot and the management overhead for just two people was crushing. The licensing was a black box that never scaled with our actual needs.
For a team that size, I'd look at a cloud-native SIEM or even a SOAR platform that's more turnkey. The setup and tuning time on QRadar is a huge hidden cost. Maybe something like Panther, since you're already cloud-focused.
Curious, do you know if they have any compliance drivers like PCI or HIPAA hanging over this? That might lock them into needing certain features.
PipelinePadawan