We performed a comparison between IBM Security QRadar and Microsoft Defender for Endpoint based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.
Features: IBM Security QRadar users say the solution provides extensive information and helpful leads for locating pertinent data. QRadar stands out with its comprehensive network visibility and strong SIEM capabilities. Microsoft Defender for Endpoint excels in file protection, encryption, and ransomware defense. It integrates seamlessly with other Microsoft security products. Users appreciate its user-friendly interface and scalability. IBM Security QRadar could improve its rule deployment and lower its false positive rate. Users would also like expanded storage capacity, streamlined user management, and a more mature architecture. Users say Microsoft Defender for Endpoint should improve its central console and auto-recovery feature. Reviews also mentioned a need for better reporting capabilities and integration with third-party platforms.
Service and Support: Some customers of IBM Security QRadar have had trouble connecting with knowledgeable support staff and experienced delayed responses. Microsoft customer service garnered mixed feedback. Some customers commend the fast response time and expertise of the support engineers, while others express dissatisfaction with slow replies and a lack of coordination among the support teams.
Ease of Deployment: IBM Security QRadar's initial setup can be complex for users without expertise, and the difficulty may vary depending on the size of the data set. Microsoft Defender for Endpoint's setup is straightforward, especially when it’s preloaded on Windows 10. While it can be more complex for larger organizations, it is generally considered simple, particularly for smaller companies or those familiar with Microsoft environments.
Pricing: IBM Security QRadar can be costly because users need to buy new hardware to upgrade. Microsoft Defender for Endpoint is fairly priced, and it is typically included for free with Windows or Microsoft Office 365 subscriptions. However, some users believe that Microsoft's pricing could be more affordable, and others noted that their licensing models can be complex.
ROI: IBM Security QRadar delivers a high return on investment, improving security through its advanced user behavior analytics. Microsoft Defender for Endpoint delivers cost savings, enhanced efficiency, and heightened threat management.
Comparison Results: Our users prefer IBM Security QRadar over Microsoft Defender for Endpoint. The advanced security features and overall strength of QRadar make it the favored option. Users like QRadar's extensive and actionable insights, user-friendly interface, and adaptability. QRadar offers a comprehensive overview of network activity and risk management.
"Fortinet FortiEDR's scalability is quite good, and you can add licenses to the solution."
"Forensics is a valuable feature of Fortinet FortiEDR."
"The setup is pretty simple."
"The main thing is that I feel safe. Because the processes that have been used to get a handle on the attackers are much better than other competitors"
"The stability is very good."
"It is a scalable solution...The initial setup of Fortinet FortiEDR was straightforward."
"Ability to get forensics details and also memory exfiltration."
"he solution is an anti-malware product that integrates well with other vendor products such as firewalls, SIEM, etc. It captures threat intelligence and gives you better visibility. The product also has sandboxing features."
"The playbook engine is flexible and allows for the graphical visualization of processes, enabling the implementation of dynamic playbooks for incident response or testing."
"It has very rich functionality."
"One very useful feature is the plug-in offering that allows you to integrate it with other solutions, such as integrating it with plug-ins like Scout, Carbon Black, and the rest."
"The most valuable feature is user behavior analytics (UBA)."
"In terms of the most valuable features, the log collections and log processing mechanisms are good. They have good dashboards."
"Log correlation is very useful for processing alerts. It serves to follow up alerts in real-time, building an entire workflow."
"The support is very good. We get support whenever we need it. Sometimes they respond immediately and sometimes it will be within 24 hours. We can ask them to please do it right away and they can get a request done within an hour or two."
"The best part of this solution is having a third-party SOC."
"The antivirus features are very useful."
"It's one of the best antiviruses on the market."
"Microsoft Defender for Endpoint is easy to load and it runs quietly in the background, unlike other solutions."
"It's really stable. I've used a lot of stuff, a lot of products, like ESET and Kaspersky. None of them are comparable with this one. This one is much better."
"The most valuable features are that it's easy to use and the updates are very simple."
"It's a Microsoft product; it's easier to deploy this product than other options."
"I like that Defender is integrated and doesn't have a third-party payload trying to advertise subscription renewal."
"Its real-time security is the most valuable."
"ZTNA can improve latency."
"The solution should address emerging threats like SQL injection."
"There's room for improvement in the quick response time and technical support for integration issues, especially when dealing with multiple vendors."
"I would like the solution to extend beyond endpoint protection and include other attack surfaces such as other network components."
"FortiEDR could add a separate scanning dashboard. In incident management, we prefer to remove the endpoint system from the environment and scan the system. We typically use Symantec for that, but if we want to use FortiEDR for that, then we need a scanning tab to clarify things."
"I haven't seen the use of AI in the solution."
"We'd like to see more one-to-one product presentations for the distribution channels."
"The solution's installation from a central installation server could be improved because the engineers had a little bit of trouble getting it installed from a central location."
"We need more features in order to create rules to detect or to meet some requirements for other areas, for example, catching the event from other authentication tools."
"Some UI enhancements would be nice, such as exporting custom event properties and the ability to export rules."
"The solution lacks vendor support."
"We would like to see better instrumentation for debugging changes in the log flow."
"The implementation of the solution's technology needs to be simplified."
"The AI engine could be smarter."
"I'd like them to improve the offense. When QRadar detects something, it creates what it calls offenses. So, it has a rudimentary ticketing system inside of it. This is the same interface that was there when I started using it 12 years ago. It just has not been improved. They do allow integration with IBM Resilient, but IBM Resilient is grotesquely expensive. The most effective integration that IBM offers today is with IBM Resilient, which is an instant response platform. It is a very good platform, but it is very expensive. They really should do something with the offense handling because it is very difficult to scale, and it has limitations. The maximum number of offenses that it can carry is 16K. After 16K, you have to flush your offenses out. So, it is all or nothing. You lose all your offenses up until that point in time, and you don't have any history within the offense list of older events. If you're dealing with multiple customers, this becomes problematic. That's why you need to use another product to do the actual ticketing. If you wanted the ticket existence, you would normally interface with ServiceNow, SolarWinds, or some other product like that."
"Right now, if you look at the compatibility, if you need to deploy QRadar in a physical appliance you have only two choices of server, their own or a Lenovo server. In today's world, you cannot keep something tied to such a big brand. Clients want to be able to use whatever type of server they want."
"The deployment of Microsoft Defender for Endpoint on Windows 10 is not quite so straightforward. This could be made easier."
"Lowering the price would be an improvement."
"The integration and effectiveness of email security could be better. It's already built-in to the solution and checks emails, scans the links they contain etc."
"Threat intelligence has the potential for improvement, particularly by integrating more sources."
"There are alternative solutions that offer a greater range of dashboard insights when compared to Microsoft Defender for Endpoint."
"There are likely some technical improvements or features that could be added, however, I cannot say, off the top of my head, what they would be."
"It would be helpful if they included XDR features, on top of the EDR functionality."
"The biggest issue I had with Microsoft Defender for Endpoint was the antivirus and ransomware. I wanted central visibility over all the machines that we operate."
More Microsoft Defender for Endpoint Pricing and Cost Advice →
IBM Security QRadar is ranked 20th in Endpoint Detection and Response (EDR) with 198 reviews while Microsoft Defender for Endpoint is ranked 1st in Endpoint Detection and Response (EDR) with 182 reviews. IBM Security QRadar is rated 8.0, while Microsoft Defender for Endpoint is rated 8.0. The top reviewer of IBM Security QRadar writes "A highly stable and scalable solution that provides good technical support". On the other hand, the top reviewer of Microsoft Defender for Endpoint writes "Eliminates the need to look at multiple dashboards by automatically providing one XDR dashboard to show the security score of each subscription". IBM Security QRadar is most compared with Microsoft Sentinel, Splunk Enterprise Security, Wazuh, LogRhythm SIEM and Elastic Security, whereas Microsoft Defender for Endpoint is most compared with Symantec Endpoint Security, Intercept X Endpoint, CrowdStrike Falcon, SentinelOne Singularity Complete and ESET Endpoint Protection Platform. See our IBM Security QRadar vs. Microsoft Defender for Endpoint report.
See our list of best Endpoint Detection and Response (EDR) vendors.
We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.