IBM QRadar SIEM: pricing, ownership, MITRE coverage
Byline: Oliver Wakefield-Smith, Founder, Digital Signet.
IBM QRadar SIEM[9] sells on Events Per Second plus Flows Per Minute. Channel reports a $10K/yr smallest 100-EPS commercial tier on-prem. Maintenance adds 20-25%/yr on perpetual licenses.
The Palo Alto handoff
In September 2024 Palo Alto Networks completed the QRadar SaaS acquisition[10]. IBM is migrating QRadar SaaS customers to Cortex XSIAM. The on-prem QRadar appliance remains IBM-owned and sold, but is in steady-state, not roadmap-forward.
Net-new buyers
A 2026 net-new buyer should not shortlist QRadar SaaS. On-prem QRadar still fits a small set of regulated workloads with strict data-residency requirements where neither Cortex XSIAM nor Sentinel meet the criterion.
What shifted
Palo Alto Networks acquired IBM's QRadar SaaS business (announced May 2024, closed September 2024). IBM is migrating QRadar SaaS customers to Cortex XSIAM. QRadar on-prem remains IBM-owned and sold but is in steady-state, not roadmap-forward. Pricing reference at https://www.ibm.com/products/qradar-siem[9].
Ingest TCO strip
| Vendor | Annual TCO | Basis |
|---|---|---|
| Splunk Enterprise Security | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Microsoft Sentinel | $785K | Analytics Logs PAYG $4.30/GB times annual ingest with retention adjustment. |
| Google Chronicle Security Operations | $8K | Standard tier $0.65 per employee per month times headcount. 12-month retention included. |
| CrowdStrike Falcon Next-Gen SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| IBM QRadar SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Exabeam New-Scale Fusion | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| LogRhythm Axon | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Securonix Unified Defense SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Sumo Logic Cloud SIEM | $456K | Cloud Flex effective $2.50/GB at Enterprise Suite times annual ingest with retention. |
| Elastic Security | $173K | Serverless ingest $0.85/GB plus a baseline VCU/storage allocation. |
| Panther Cloud-Native SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Palo Alto Cortex XSIAM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| SentinelOne Singularity AI SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Rapid7 InsightIDR | $101K | Per-asset $5.62 per month at the entry tier (500-asset minimum). |
| Stellar Cyber Open XDR + SIEM | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Devo Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Snowflake Cybersecurity Workload | $219K | Estimated $1.20 effective per ingested GB across credits and storage at standard tier (excludes detection layer). |
| Anvilogic | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Hunters SOC Platform | Quote | Quote-only. Request an RFP-grade quote before benchmarking. |
| Graylog Security | $274K | Cloud Security tier list approximately $1.50/GB times annual ingest with retention. |
You enter GB/day. You get an annual number per vendor that publishes a unit price. Quote-only vendors are blocked, not estimated.