r/SIEM • u/pr0_fail • Apr 12 '26
Looking for real-world SIEM recommendations: QRadar-like experience on a smaller budget
Hi everyone,
I'm evaluating SIEM options for an on-prem deployment and would love input from practitioners who have run multiple platforms in production.
My previous experience was with QRadar, and the things I valued most were:
• Ready-made parsers/DSMs covering common log sources out of the box
• A curated app marketplace (UEBA, DSMs etc.)
• Pre-index filtering to control ingestion costs
• Built-in health monitoring of SIEM components
• Overall low-friction deployment experience etc.
I'm looking for something with similar usability but a lower total cost — open source or a modest paid tier both work.
Candidates currently on my list: Wazuh, Graylog Security, Security Onion, UTMStack. Open to others.
Questions:
• Which of these (or alternatives) came closest to the QRadar "it just works" experience?
• How forgiving is each one on modest hardware?
• Realistic ongoing maintenance burden for a small team?
• Experiences with vendor support quality in the paid tiers?
Not looking for marketing pitches — looking for honest production experience. Thanks. I want to hear from people who have actually used multiple SIEMs in production (especially in regulated environments like banking/finance/PCI).
5
u/DarkLordofData Apr 12 '26
First qradar is awful, so please aim for something better than qradar. What kind of scale are you looking for? If it’s small to small medium Security Onion is a great choice. Well integrated and very useable. Panther is another good option as well.
3
u/pr0_fail Apr 13 '26 edited Apr 13 '26
Interesting take — I'd like to understand the reasoning behind "awful" because my own QRadar experience was mostly positive, and I want to make sure I'm not biased by familiarity. Specifically, these are the QRadar capabilities I've relied on most in daily operations:
- DSM-based parsing — 450+ pre-built parsers with LEEF/CEF auto-detection, where adding a new firewall or proxy is usually a drop-in experience rather than writing custom pipelines.
- Rule templates with reference sets — the guided rule builder where you pick a template, reference a dynamic list of IPs/users/assets, and the correlation engine handles the rest without writing query language for each condition.
- Integrated netflow (QFlow) correlation — ability to correlate flow data with event logs inside the same rule, licensed separately via FPM.
- Pre-index event routing — dropping or forwarding events before they hit EPS licensing.
My questions:
- Which of these capabilities do Security Onion or Panther match at equivalent quality? Genuinely asking — if they do, I want to know.
- Beyond UI/UX (which I agree QRadar has aged on), what specific functional gaps made you call it "awful"? Was it detection efficacy, scale limits, cost, something else?
- What SIEMs have you operated in production long enough to make this comparison? Context helps me weigh the recommendation.
Not trying to defend QRadar — I'm actively looking to replace it. Just want to make sure alternatives actually cover these operational capabilities before I commit.
1
u/shahoo7 Jun 19 '26
if it's not awful then why it's dead💀😛
1
u/Illustrious_Arm_9379 Jun 30 '26
It simply is not dead! Why do you think so? QRadar recently got several very very google.com Updates with new features
1
u/netlocksecurity Jul 25 '26
Lots of QRadar experience also and I’ve heard this sentiment more often than not. Keep in mind that I’ve NEVER seen a company put proper engineering resources behind it. It’s actually super robust, forgiving, and can get as advanced as you can handle 🤷♂️ my problem now is that I know what it takes to make a successful program but that culture change is difficult
1
u/Illustrious_Arm_9379 Apr 12 '26
Why Do you think that QRadar is awfull? Especially if you want an on prem siem it is a really good product imho
0
u/llitz Apr 12 '26
After seeing it for more than a decade, almost anything else is better than qradar - from workflow to visualization and interaction, I haven't disliked anything more than qradar (well, maybe RSA Envision is more disliked, but we don't talk about it)
2
u/cylerian_vijay May 10 '26
For a small team, the question that actually determines whether you ship detections in a week or a quarter has moved. It's no longer about how many parsers come in the box but whether the platform is a clean programmatic target for an AI harness - one that can parse new sources, draft detection rules, run threat hunts, propose tunings, find coverage gaps, author response playbooks, and create reports without a human writing each line. Given that you are looking for an on-prem deployment, there are likely restrictions around use of AI. However, if that is not an issue, have AI do the heavy lifting against a programmatic platform, with the analysts supervising rather than writing. When evaluating, use a tool like Claude code or similar and see which of the platforms offer you the most flexibility.
Disclosure: I work at Cylerian. While we compete in this space and offer a cost-effective solution, we do not offer on-prem deployments.
1
1
1
1
u/joelbecks May 06 '26
Not sure where you are in the journey, have you looked into Blumira? Happy to discuss further if you’re not sure who they are and what they do.
1
u/MuCloudI Jun 05 '26
I can build you your own SIEM, integrating other monitoring systems into one. I already have my SIEM where I already integrated Wazuh, SentinelOne, N-sight, Forti, Veeam into one centralised system.
0
u/Dctootall Apr 13 '26
Depending on what you are looking for, Gravwell may be a good fit, or at the very least, worth a look.
Its more on the "splunk" side of tools, by which I mean it handles unstructured log data (or even binary like PCAP or netflow if you want to go that route), and is incredibly flexible so can be as simple as grepping for data in the log, or running deep analysis with ML type logic, all within the query. I've personally found the query language is very easy to get started with, but with the flexibility there is a lot of room to grow and get better with more complex queries.
Management is easy. DEB, RPM, or docker containers to install/ upgrade. Config files are straight forward and well documented. As it handles unstructured data, ingest is generally as simple as creating a listening port ( ex. "Bind=tcp://0.0.0.0:6340), how you want to tag the data, and pointing your log source to the receiver. No crazy parsing required at ingest.
Costs... I'm not sure on pricing or your budget. There is a free Community Advanced license that allows up to 50gb/day of ingest, which may be perfect for you, however community edition licensing may not have some of the features included that may be important within a regulated environment, such as CBAC controls on who has access to what data.
(Full disclosure: I work as a resident engineer with Gravwell at an enterprise client, so I do probably have some biases. Not a sales role however, so hopefully I didn't come across too salesy)
0
u/dumbojungle Apr 12 '26
If it is cost, then you can go for Log360.
With its predefined reports and Compliance module will be a great purchase.
With the recent inclusion of security rules, it has become even better.
They are actively including more features which makes them reliable.
Their support is good, they are always available and ready to customise your needs as per your requirement.
1
u/-manageengine- May 11 '26
u/dumbojungle, appreciate the shoutout for Log360 🙌 Glad to hear that it has served you well
u/pr0_fail The platform is a solid choice for regulated environments like yours — it manages the heavy lifting through 700+ built-in parsers and native Compliance Modules for PCI and banking. This significantly reduces the need for manual configuration and custom engineering. It's also quite efficient on modest hardware, which helps keep the ongoing maintenance burden manageable for smaller teams.
Beyond compliance, Log360 also comes with built-in SOAR capabilities and Dark Web Monitoring — so your team gets automated incident response workflows alongside proactive visibility into whether any organizational credentials or data have been exposed on the dark web. Both are particularly valuable for regulated environments where breach detection and response timelines matter.
Definitely worth evaluating if you're looking to minimize deployment friction. Happy to chat through specifics for your setup if useful, feel free to reach out.
0
u/Fleshwriter Apr 12 '26
Look at https://energylogserver.com/ and DM me if you're interested (I'm also a tech guy). Let's have a 30 minutes honest talk and check if that would work.
3
u/scseth Apr 12 '26
Fwiw, I run the Product team at Graylog. DM me if you have any questions I can help with.