Try our new research platform with insights from 80,000+ expert users

Fortinet FortiSIEM vs IBM Security QRadar vs Trellix ESM comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

As of July 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Fortinet FortiSIEM is 3.3%, up from 3.0% compared to the previous year. The mindshare of IBM Security QRadar is 7.7%, down from 9.7% compared to the previous year. The mindshare of Trellix ESM is 1.0%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM)
 

Featured Reviews

Oliver Jackson - PeerSpot reviewer
Systems monitoring enhanced by firewall and intrusion detection features
My primary use case for Fortinet FortiSIEM is systems monitoring and alerting. I use it for standard functions like log monitoring, incident detection, and notification.  My customers are mostly medium-sized enterprises ranging from engineering companies, mining companies, independent schools, and…
Mahmoud Younes - PeerSpot reviewer
Reliable installation and diverse use cases provide strong value
IBM Security QRadar has some areas for improvement. We have missed some DSM components. We need to customize logs where there is no DSM or connector for certain products. We can integrate but we have missed the DSM, which is the connector to pass logs coming from different applications. For example, with a university customer, we tried onboarding Canvas service. IBM Security QRadar does not support Canvas, so we had to create custom scripts and workarounds to pull logs from Canvas.
Daniel Durian - PeerSpot reviewer
Helps to monitor and detect cyberattacks
The tool's effectiveness depends on how you define your log sources. To build visibility of incoming and outgoing traffic, you need logs from perimeter defense, firewalls, web application firewalls, and endpoint protection. With good traffic visibility, incident response time is really quick. Trellix ESM provides situation awareness. On the dashboard, I can see outbound and inbound communications to known threat hosts, IPS/IDS activity, and threat intelligence of the perimeter defense in the firewall. This information helps preempt attacks.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution’s IP database is awesome."
"The most valuable feature is the anomaly-reporting alarms."
"Analytics. It can provide log information from the device. With log information, I can see if there is a threat"
"FortiSIEM allows you to match IPs with threat intelligence feeds from sources like Kaspersky or Anomali, adding valuable context."
"One of the most valuable features is that we can combine SOC and NOC operations in the same tool. We can provide NOC and SOC services in the same tool for two separate teams. There are plenty of third-party solutions that integrate with FortiSIEM. All these solutions already have a ready integration, and we have the possibility to create a custom connector for these solutions. Its reports are also very good."
"The primary valuable feature is that it has replaced a whole lot of other products with one platform."
"The interface is very easy to use. The connector in the core has FortiSIEM support from the vendor."
"The event correlation is pretty robust. The GUI is pretty good."
"My overall rating for this solution is nine out of ten."
"IBM QRadar has improved my organization by introducing many functions. It collects logs from all of our systems in the organization and has functioned very well. It alerts and correlates the aggregate events or offenses we receive through all the applications we use."
"We get events and make the correlation, or rules. In IBM, we can implement our customer's rules. We can have very clear status threats and severity of antigens."
"This is a distributed application, meaning that a customer can stack small and then scale it so that they can expand pretty effectively. You can use, basically, the same product in an SMB or a large enterprise."
"IBM QRadar User Behavior Analytics has easy architecture, has a good portfolio and integration."
"It also has a graph that shows the traffic history. I can see what happened yesterday or today. If there's an incident, I can check the traffic behavior on QRadar."
"It has improved my efficiency."
"The correlation and the parsing are important features, since it is very important for a SIEM to have a good scalability and performance."
"It is easy to use and deploy. It comes with user-friendly manuals."
"It blocks the things which are not to be allowed. It has an adaptive mode where it learns for itself."
"It enables us to detect malicious threats, issues, or vulnerabilities in our network."
"This solution integrates easily and very well with other technologies."
"The ease of use is the most valuable feature. Over the years I have always been using this solution and have become comfortable with it."
"It has good technical support, which is available around the clock. You can call up anytime and get whatever you want. My queues are resolved."
"I like the ease of deployment."
"The most valuable feature is the correlation rules."
 

Cons

"The log collection and configuration management are not great."
"Fortinet FortiSIEM should broaden its remediation part to include more features for incident management. Currently, to manage repetitive incidents or for remediation, I need to use a separate software called FortiSOAR."
"The deployment of the platform took some time to set up and configure."
"FortiSIEM could be better integrated with other vendors."
"Fortinet FortiSIEM needs to provide better API integrations to users."
"The graphs on the user interface could be improved as we often experience glitches."
"FortiSIEM is not a market leader in the SIEM space."
"The nodes on our network did not comply with the SIEM solution. They use a different format parking log."
"The only challenge is that IBM has been a closed enterprise. It should be more open to integrating with other providers at an enterprise level. We're a bank and the core banking system integration is not way straightforward and there is no integration between IBM and these products. If IBM could open up and provide a way of integrating it seamlessly, without charging more for it, that would make a big difference."
"The product needs to improve its GUI."
"There needs to be better integration with other applications."
"The user interface needs improvement."
"The user interface is a bit difficult to get used to."
"In terms of additional features, a mobile app would be nice. Also, the reporting is definitely okay, but you have to make sure that everybody with different roles can understand it. There is room for improvement in the reporting."
"IBM needs to invest more into the collaboration with other vendors."
"There should be more opportunity for community kind of distribution where, for example, if there was a zero-day threat targeting companies."
"We would welcome integrations with some of the new McAfee acquisitions, e.g., behavioural analytics."
"We need to improve Trellix ESM by making sure that most of the logging devices available in the global market should be covered, and if there is any device which is not covered, there should not be any additional charges for writing the custom parsers on that."
"I would like to see improvements to the user interface."
"There's no software support from McAfee."
"The user interface could be more user-friendly."
"There should be support for multitenancy in the product."
"It seems McAfee does test its product before releasing. When we - not only us, other companies also - deploy McAfee, we face multiple issues from the customer side, after which, McAfee reacts and fixes the bugs."
"It is not a very advanced solution, and it is for very generic use cases. It cannot cope with the advanced requirements that we're going to have. For example, for multiple authentication failures, it is still based on Windows events for detecting multiple login failures, whereas other companies are going beyond and working on implementing two-factor authentication. It is time to correlate the two-factor authentication results with authentification failures, which is not happening with McAfee ESM. The performance of the tool should be improved because it is very slow. The data display on the console is very slow in McAfee ESM. Its data storage is still old-fashioned, and it should be improved and upgraded to the latest versions. They have to come up with some new ideas to match what other leaders in the same domain are doing. For example, in Splunk, when you search for information for the last 60 days or five months, it quickly shows the information, but that is not the case with McAfee. The results should be quicker and faster on the console. They should integrate some additional features such as User Behavior Analytics (UBA) and automation. The threat intelligence part should also be improved on McAfee."
 

Pricing and Cost Advice

"Fortinet FortiSIEM is cheaper compared to other products."
"Its price can be better. We are Fortinet partners, so we can get discounts, but its price can be an issue at the beginning for others. There is a licensing scheme for every case. There are three licensing schemes that we can choose from."
"Pricing is acceptable for more than 90% of our customers, as they normally get discounts."
"The solution is available for both, perpetual and subscription licenses."
"The price of Fortinet FortiSIEM was reasonable compared to other solutions."
"Fortinet's products are not expensive, it is less than the competition."
"We bought the perpetual license, so we own the product, but there is a three-year support renewal fee for that."
"FortiSIEM's licensing is based on EPS, and its pricing is competitive in the market."
"When compared with other SIM solutions, QRadar is considerably less expensive."
"think the pricing is quite flexible."
"found other solutions, with more features at the same cost or less. You don’t have to leave the Gartner Magic Quadrant to beat their price."
"Only enterprise businesses can afford the tool."
"It is very expensive."
"It's too expensive. The licensing is also a little bit difficult to understand because you have to license it per event and per number of flows."
"It is a perpetual license that we have for the event collector. The licensing is done based on the number of events and flows that you receive on this particular device. These are perpetual licenses, which means once you purchase them, they don't expire, which means that the support to IBM is definitely renewed after every one year. We have an enterprise agreement with IBM, which puts the cost in a totally different category as compared to someone who is not an IBM partner and is approaching IBM for this solution. We were able to get massive discounts. To give you an idea, we recently purchased 30,000 event licenses, and it costs around $480,000. It is definitely not a cheap product. We have licenses for about 270,000 events per second and 3 million flows per second. All the appliances and their events and flows are basically clubbed together and charged or rather calculated through a single source. The console receives all the details from all the event processes that we have globally. So, the license that we have is a single license for 270,000 events per second and 3 million flows per second, but that can be managed centrally. I was only part of the secondary purchase, which was 30,000 events per second for about $480,000. You can calculate how much we paid for 270,000 events. Reducing its price would be a compromise. We have already used a lower-priced product in the form of NNT, but we had to get rid of it because it was not doing the job that we actually wanted to do. You get what you pay for."
"QRadar's price is reasonable compared to LogRhythm."
"You should buy the distributed option instead of the all-in-one for environments with more than 1000 end points."
"When compared to IBM Security QRadar and other similar platforms, the pricing of McAfee ESM is reasonable and comparatively less expensive."
"The pricing is fair."
"The cost is all included. The finance department handles the financial part, and we mostly don't get involved in it."
"The product is slightly expensive."
"The pricing is good, and they are competitive compared to providers such as RSA and IBM QRadar."
"McAfee is the right choice for a low-budget solution."
"The price is good. It's moderate. We follow a pay-as-you-go model. There are different models available, and they can also be monthly. You can choose monthly or yearly. It's very flexible. If our existing customers exceed the current plan, you can just call McAfee and get it extended."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
862,543 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
9%
Government
7%
Comms Service Provider
7%
Computer Software Company
16%
Financial Services Firm
12%
Government
7%
Manufacturing Company
7%
Computer Software Company
13%
Comms Service Provider
13%
Financial Services Firm
12%
Manufacturing Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Fortinet FortiSIEM?
Fortinet FortiSIEM needs to provide better API integrations to users.
What is your experience regarding pricing and costs for Fortinet FortiSIEM?
The pricing is reasonable, which is why it is preferred by government customers. Windows agent licenses cost around 3...
What needs improvement with Fortinet FortiSIEM?
Fortinet FortiSIEM should broaden its remediation part to include more features for incident management. Currently, t...
What are the biggest differences between Securonix UEBA, Exabeam, and IBM QRadar?
It mostly depends on your use-cases and environment. Exabeam and Securonix have a stronger UEBA feature set, friendli...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...
What is your experience regarding pricing and costs for IBM Security QRadar?
When comparing with Splunk, IBM Security QRadar's cost is reasonable. Splunk is more expensive than IBM Security QRadar.
What do you like most about McAfee ESM?
The solution's technical support is great.
What is your experience regarding pricing and costs for McAfee ESM?
When discussing Trellix ESM pricing and licensing, if you consider some premium product, the pricing also has to be p...
What needs improvement with McAfee ESM?
We need to improve Trellix ESM by making sure that most of the logging devices available in the global market should ...
 

Also Known As

FortiSIEM, AccelOps
IBM QRadar, QRadar SIEM, QRadar UBA, QRadar on Cloud, IBM QRadar Advisor with Watson
McAfee ESM, NitroSecurity, McAfee Enterprise Security Manager
 

Overview

 

Sample Customers

FortiSIEM has hundreds of customers worldwide in markets including managed services, technology, financial services, healthcare, and government. Customers include Aruba Networks, Compushare, Port of San Diego, Cleveland Indians, Infoblox, Healthways, and Referentia.
Clients across multiple industries, such as energy, financial, retail, healthcare, government, communications, and education use QRadar.
San Francisco Police Credit Union, Wªstenrot Gruppe, Volusion, California Department of Corrections & Rehabilitation, Government of New Brunswick, State of Colorado, Macquarie Telecom, Texas Tech University Health Sciences Center, Cologne Bonn Airport
Find out what your peers are saying about Splunk, Wazuh, Microsoft and others in Security Information and Event Management (SIEM). Updated: July 2025.
862,543 professionals have used our research since 2012.