Q1 Labs QRadar
QRadar started off less as a SIM tool and more as a network traffic anomaly detection suite, but Q1 has added features, such as a correlation engine, the ability to take data feeds from multiple device types and a reporting engine, that make it competitive in the SIM market.

Q1 and OpenService are the only vendors in this review that support both software-only and turnkey delivery models. We opted to go the turnkey route, and Q1 delivered a 2102 QRadar server appliance and a 1101 flow collector appliance. We used the flow collector only to gain greater visibility into our environment; all the SIM-related smarts were in the 2102 server. The 2102 takes flow data from infrastructure devices, but gives customers the flexibility to deploy a standalone collector-- a nice option and one that we used.

QRadar's correlation language is one of the easiest to learn. Unlike the rule-building sets in products from ArcSight and Symantec, QRadar's scripting language is probably as close to English as you're going to get. It's also somewhat hierarchical and recyclable, letting you use what Q1 calls "building blocks" to string logic sequences together. Although all the products required time to learn the correlation techniques, we were most comfortable using QRadar's methods.

We also liked that our logs could be viewed easily; we didn't have to rummage through the UI to get to them. This let us pinpoint a problem with QRadar's parsing of our PIX 7.0 logs, and Q1 turned around a fix in 24 hours. Had we not had easy access to the raw log data, it would have taken us a lot longer to pinpoint the problem. Most of the products we tested let organizations store raw events in addition to their normalized counterparts, but the raw data isn't always easily accessible.

Our biggest complaint with QRadar is with its UI; it's not a lot of fun to try to get things done within QRadar. We struggled to efficiently sift through poorly constructed HTML tables, and we often found ourselves unsure of which pane to use for what. By comparison, ArcSight ESM's Java console just crushes most HTML UIs in the usability department; Web UIs simply don't perform certain tasks well. We're not normally big fans of Java consoles because most of them are slow and kludgy, but given the choice between brutally painful HTML UIs and Java consoles that need 2 GBs of RAM, we'll opt for the Java--RAM is cheap. The console shortcoming won't be a big deal for those simply running some reports occasionally, but analysts spending hours in front of the console will likely find themselves getting uncomfortable over time without some improvements.