IBM Resilient Reviews

We have a team for case management that builds use cases for the solution. We use the solution for SOC analysis.

The product is very good at incident response. We have integrated our security with it. We have a firewall and have integrated our domain controller with IBM Resilient. If we want to contain any alert, we can do it using the product. It has been a great tool for the SOAR platform or automation. It is very beneficial. We were able to control the mean time to escalate (MTTE) metrics with the help of the solution.

The sources that the product integrates are not enough. It does not integrate with some of the good tools in the market. The product must provide more integration with other tools. If the solution improves these things, it will become a perfect tool for incident response.

I have been using the solution for six years.

We faced some issues with stability earlier. We spoke to the support team, and they gave us an updated version of the tool. After the upgrade, it was quite stable.

The tool is quite scalable. However, a few of our customers faced some issues after onboarding. The issues were resolved after we received support. Our customers are small, medium, and enterprise-level businesses. The service is purely based on the license they purchase.

Support was quite good.

Positive

It is quite easy to install the product.

The deployment can be done within a day. Our team has around eight people who are part of the deployment. We have a solution architect in the US who works on the architecture. The rest of the team members work on the solution's day-to-day operations, installation, and upgrade. Our team of eight people maintains the solution.

The cost of the product is quite high. We pay a yearly licensing fee.

Certain vendors within the market, like Palo Alto, have SOAR platforms. Compared to these tools, IBM Resilient is lagging. IBM Resilient does not have the good support and security features that other tools have. IBM Resilient is quite good in integrations. Palo Alto has a lot of products for firewalls, endpoints, and threat intelligence. The connectivity between Palo Alto products is very good. IBM Resilient lacks these features. However, the solution has promised to build such capabilities.

IBM Resilient is a good tool for medium or big organizations. Before buying the product, we must check whether IBM Resilient supports the security tools we have. Then we can leverage the tools. Overall, it is a good tool for incident response. We have seen multiple incidents where the containment was done by the tool. We don't have to use different tools for containment. The solution is one of the oldest tools for the SOAR platform. I will not rate the tool a ten out of ten because there are some glitches that need improvements. Overall, I rate the solution an eight out of ten.

Our usage of IBM Resilient was primarily limited to communication and incident resolution. Although there was some automation implemented, we experienced delays from the technical side. Therefore, we only utilized it for incident logging, team communication, and documentation purposes. In case of any future incidents, we could easily refer back to the records.

The solution is reliable in our usage.

Integrating IBM Resilient with other applications can be very difficult and technically challenging. Often, they use the excuse that you are using the latest version of an application, such as an endpoint security system, and they don't have an API or support for it at the moment. There is no automation in the SOAR solution.

It's worth noting that many third-party add-on applications needed to be purchased separately to integrate with IBM Resilient. While there were built-in applications available for incident remediation, the selection was limited. Additionally, integrating third-party applications was often a difficult and time-consuming process due to the technical complexity involved.

I have been using IBM Resilient for approximately three years.

IBM Resilient was stable in terms of load and user management. We had unlimited licenses for creating users across different teams, allowing us to efficiently manage and address incidents. This made it easy for us to raise and respond to incidents without any limitations.

The solution is scalable, we had the ability to add unlimited users.

IBM Resilient is not difficult to install as it is based on a simple image that can be installed with just a few clicks for license setup. If you are deploying it on-premises, you just need a VM for deployment. Once it is set up, you can access the web interface from your system and proceed with license deployment and configuration. However, customizing it to meet your specific needs can be time-consuming as it is a mature product that requires careful consideration.

We could create unlimited users using the license we had purchased.

As most solutions nowadays come with SOAR capabilities, I wouldn't recommend IBM Resilient. For example, when we were using IBM QRadar, it didn't have incident management features, so we had to integrate it with IBM SOAR to receive that functionality. It seemed as if IBM was trying to force customers to purchase another SIEM from them if they wanted to use SOAR. It would make more sense to have the SOAR and SIEM combined into a single solution like LogRhythm, Microsoft Sentinel, or Splunk.

I rate IBM Resilient a six out of ten.

I use IBM Resilient in my company to manage areas like automation of non-easy tasks and to be able to integrate with other security controls in our environment. The tool is also useful to manage areas like ticketing and case management.

The configuration area to deal with during the very beginning or initial stages of the product can be the hardest part for users. Dealing with the configuration part in the beginning stages can be difficult since it is very important for users to have the capability to identify what is required within the tool and what you want to automate. The product's configuration during the beginning stages can be an area that needs to be considered for improvement.

The response time of the support is an area of concern where improvements are required.

I have been using IBM Resilient for three years. My company has a partnership with IBM.

It is a stable solution.

It is a scalable solution.

The solution's technical support was good. I rate the technical support an eight out of ten.

Positive

In my company, IBM Guardium Data Protection is used for monitoring purposes, specifically by those who manage the company's SOC area. With the tool, it is possible to have a centralized location for all the logs, and it helps with a correlation of use cases, specifically the ones related to security.

My company uses Imperva for database activity monitoring and data security.

The product's initial setup phase was a bit difficult, but my company received all the support we needed from IBM. During the initial setup phase, my company faced some unexpected challenges during the process within our environment. There will be some issues or problems during the product's installation phase.

The solution can be deployed in around 40 days.

The deployment process was carried out with the help of two people in our company.

The product offers good value in terms of money. The product's use in our company saves around 80 percent of our time.

The product is expensive. There is a need to make yearly payments towards the licensing costs attached to the solution. There are no costs except for the support services that our company pays in addition to the licensing charges attached to the solution.

I use IBM Resilient in my company for incident response and management within our organization by temporarily integrating the tool with the firewall, considering the fact that it can block attacks after we automate many of the processes.

IBM Resilient has helped streamline our company's cyber resilience and security operations, and it helps save time for our analysts. If someone else tries to take care of the aforementioned process manually and carry out investigations alone, then such a person may see that it is not an easy or simple task. The tool takes care of the tasks by itself, saving time for my company.

The features of IBM Resilient that I found to be most effective for automating our company's security incident response processes stems from the ease of operations that the product provides ease of use in areas like workflows and playbooks, making it a product that ensures its users experience ease of development when using the tool. The product also offers a lot of integration capabilities, allowing users to use the tool in a customized manner, as everything can be integrated with the solution.

The product's integration capabilities with other security tools have enhanced the incident response workflow since the integration part was easy to manage. Knowing the company's use cases and internal processes well enough can help its users identify what they want to protect and the projects they have, which in turn can make everything easy to handle in the tool.

Our company has an engineer to take care of the maintenance of the product.

In terms of the improvements I noticed in my organization's compliance or reporting since the implementation of IBM Resilient, we have complied with many standards, especially those related to our local controls. In terms of compliance, our organization was able to close many gaps.

I recommend the tool to those who plan to use it.

I rate the overall tool an eight out of ten.

In my company, we use IBM Resilient SOAR.

One of the drawbacks of the solution stems from the fact that it is an expensive product. The solution's price is an area where improvement is required.

There are shortcomings with IBM Resilient's technical support team that can be considered for improvement in the future.

I have some experience with IBM Resilient. Though my company purchased IBM Resilient a year ago, we have started utilizing the product in our environment. In my company, we are currently in the playbook development phase when it comes to IBM Resilient. My company plans to implement the solution soon. My company is a customer of IBM.

The solution has been stable, but it requires some administrative follow-up.

It would take three or four months to understand how many people in my organization will be using the solution since we have not yet fully utilized it.

IBM Resilient's support team has been very good since they have been willing to offer good support to my company for everything. IBM Resilient's support team is also very responsive whenever my company contacts them.

Sometimes, when there is a switch from one support team to another, I have seen some gaps in the technical support provided by IBM, making the process not so smooth. The first response from IBM's support team takes time and may not offer a rapid response, especially when there are urgent requests from a user. In a few cases, I have observed that a rapid response from the technical support team of IBM is not available.

I rate the technical support a seven out of ten.

Neutral

I have some experience with Palo Alto. In terms of functionalities, Palo Alto is the best product. I will need to have some more experience with IBM Resilient to be able to compare it to Palo Alto. I think my experience is not enough to judge or say something about IBM Resilient.

The initial setup of IBM Resilient is not that complex since my company already has a support license that we use internally. In general, the product's deployment phase is not that complex.

The installation and configuration phases of IBM Resilient were started a year ago in my company.

IBM Resilient is an expensive product. Naturally, SOAR products are more expensive than any other products in the market. IBM Resilient is not a cheap product for my company. I feel it is an expensive product when my company pays annually for renewal, support, and follow-up.

After considering IBM QRadar, I rate IBM Resilient a seven out of ten.

IBM Resilient is a flexible cybersecurity solution suitable for different industries like finance, governance, and private businesses. It ensures effective incident response, regardless of the specific sector. Whether dealing with financial threats, governance issues, or private organization security, Resilient's tools and workflows automate incident handling, making it valuable across various sectors.

The most valuable features of IBM Resilient are its flexibility and customization options for incident response. You can easily create dynamic playbooks tailored to your needs, which sets it apart from some competitors like Palo Alto. Resilient offers comprehensive incident response capabilities, from case management to automation, threat intelligence enrichment, and even the Bridge Response Module. This flexibility and depth of features make it stand out in helping organizations effectively handle security incidents. Clients appreciate Resilient for its ability to take action swiftly and efficiently.

IBM Resilient is great in many aspects like its wide range of integrations and customizable playbooks. However, one thing to improve is how it handles data formats, which currently might require scripting for conversion to CSV before uploading. Despite this, it stands out for incident response, case management, task organization, and team collaboration, making it a strong choice for organizations compared to competitors like Demisto Palo Alto. 
When it comes to additional features, I think IBM Resilient is on the right track with its AI capabilities, like linking related incidents and providing recommended actions. It would be nice to see more enhancements in this area, but overall, it looks good.

I have been using IBM Resilient for a year.

In terms of stability, I would give it a nine out of ten. 

IBM Resilient is highly scalable. It offers a wide range of integrations and apps, making it easy to adapt to different needs. The extensive integration library and pre-packaged apps help ensure scalability and flexibility, which is a significant advantage for users. I would rate the scalability a nine out of ten. In the GCC and Jordan region, we have around four to five key clients using IBM Resilient in Qatar. In the UAE, there are more than three clients using Resilient.

IBM Resilient's technical support is usually very helpful and quick to respond, often better than other providers. If there are delays, the good thing is that you can easily escalate cases when necessary. Clients can also do this themselves, which often leads to positive outcomes, making it a strong support option. I would rate it a nine out of ten.

Positive

I have used Palo Alto before switching to IBM. Palo Alto, with its background in automation, is challenging to work with when it comes to incident handling and customization. It is difficult to onboard and customize, which can lead to high operational costs, especially when dealing with data integration. Compared to other products, it is not as flexible when you want to create custom playbooks or add new data fields, making it a less straightforward choice for many users.

Installing IBM Resilient on-premises is not difficult; it is quite straightforward. You can get it up and running in a day. However, building custom playbooks and network setups might take a bit longer, maybe around a week. But generally, you can have it fully operational within a reasonable timeframe. The installation is made easier by the frequent release of integration apps, with updates every two weeks. IBM Resilient can be deployed on-premises but is also flexible enough to be used in the cloud. It is available on Microsoft Azure, AWS, and Google Cloud, making it adaptable to various cloud providers. This flexibility allows organizations to monitor both hybrid and public cloud environments, and you can even tap into IBM's cloud services if needed. 

IBM Resilient offers an enterprise license model where you pay based on the number of users, not actions. It is affordable for users, and on average, it may cost around $120,000 USD. However, this pricing may not be suitable for very large environments where a different licensing approach might apply.

I would definitely recommend IBM Resilient to others. Overall, I would rate it a nine out of ten.

I use the solution for orchestration and managing incidents.

IBM Resilient is a pretty good tool. It sends an email asking for clearance from a notified member in case there is another identity in the system.

The best feature of IBM Resilient is the overall functionality it provides.

The ability to analyze incidents needs to be improved in the solution. It also needs to work on how to integrate installation, VMs, and other platforms. IBM Resilient needs to work on what basis one needs to anticipate an email. Though it is good and fixable, the solution also needs to consider working on how to make it possible to move to another solution for its users.

In the future, I would like to see the integration of machine learning and AI in the solution.

I have been using IBM Resilient for a year and seven months. I am using the solution's latest version.

Stability-wise, I rate the solution a ten out of ten.

Scalability-wise, I rate the solution a ten out of ten.

I rate the solution's support a ten out of ten.

Positive

The solution is deployed on the cloud and on-premises.

I have experienced an ROI using the solution.

Pricing for the solution is good, in my opinion.

I would definitely recommend the solution to those planning to use it.

Overall, I rate the solution a ten out of ten.

I didn't work in SOC and IT. However, IBM Resilient is a good tool. IBM Resilient is a good option, especially for its container capabilities. Apart from that, there isn't something for which I use the solution.

Actually, we faced some internal issues while using IBM Resilient. There are other tools simpler than IBM Resilient. So, you have to develop a new infrastructure that involves a lot of scripting, programming, and some extra work to create a very good one. FortiSOAR is simpler than IBM Resilient. It may take me three months or four months to compare between them. IBM Resilient is quite complex, including its configuration. Also, the dashboard in IBM Resilient is not good. Firstly, the IT support is not good. Secondly, the community of IBM Resilient and the steps for integration mentioned in its audiobooks were not good.

I have been using IBM Resilient for three years. I am working on an older version of the solution.

As a whole, the product is stable. So, there is not much of an issue. We have to get with the relevant team every two months or one month to update IBM Resilient playbook.

I don't know how we are using IBM Resilient, but it is scalable. Actually, we are involved in the production part, so I don't know the solution's features. With the solution, you can create multiple domains for maximum customers. We have a development domain, and we have production. We are creating everything in development. So, we are mostly moving to production, but for production, I think it's not supported. Around fifty people are using the solution in my company.

Technical support is very good.

I was involved in the deployment process of the solution. It took approximately seven months for it to be in production. We collected information from various entities before using analytics to build the DevOps. Additionally, we integrated it with the required product during the installation. I believe it was fixed later, so it took around a month or so to be in production. The maintenance of the solution is not difficult. So, sometimes you may need to contact someone who knows IR or DevOps.

We ourselves at our company were involved in the implementation process.

After evaluation, our company is planning to switch over to Fortinet FortiSOAR.

In general, we need to have some skills before working with IBM Resilient. You have to be aware of Python scripts, API and SOAR. Also, you have to be aware of instances and IR phases. If you are working for SOAR or IBM Resilient, you have to be aware of the skills, and if you are aware of the skills required, then it is easy to operate the tool. The simplicity of the tool is also attached to the tool's main functions. The vendor, the community, and the integration are things someone needs to compare between two vendors.

If I compare IBM Resilient with FortiSOAR, then my opinion might change. It is good if I see a more powerful tool, even though I don't know the feature, as A SOAR tool.

I rate the overall solution a seven out of ten.

IBM Resilient could integrate better with my tools. 

I have used IBM Resilient for about six months.

IBM Resilient is scalable. 

The company previously used Palo Alto Cortex XSOAR, but I didn't use it.  

I rate IBM Resilient eight out of 10. 

IBM Resilient is used primarily for security, particularly cybersecurity in operation centers. My company uses it to monitor the data security-related aspects of the IT infrastructure.

IBM Resilient is beneficial to my company because it gives endpoint visibility through the system's audited security and data logs. At the same time, you can monitor the communication between the systems at the network and endpoint level through IBM Resilient. Using the data from the solution, you can coordinate security data and activities, and you can audit activities from all angles, from different perspectives.

What I like most about IBM Resilient is that it has a complete stack, which means you don't need to use different OEM products because you have all you need under the IBM Resilient umbrella.

You don't need to worry much about integrations and components because you're working with tested and proven architecture.

I also like that IBM Resilient is feature-rich and has undergone a lot of iterations in different types of environments, which means that the solution is one of the most mature SIEMs in the market today.

What could make IBM Resilient better is if IBM increased the number of built-in integrations with different products from other vendors or third-party products. 

In a way, IBM Resilient is an orchestration platform, so it should allow you to orchestrate other OEMs or products from non-IBM vendors. If there were a pre-built function that lets you integrate third-party solutions with IBM Resilient, the initial setup for the solution would become easier and more flexible. Implementing or integrating other platforms with IBM Resilient would also take less time.

After the solution is implemented, that's the time my company can give more recommendations on which features to add to improve IBM Resilient.

My experience with IBM Resilient is four years.

Scalability depends on the infrastructure, not IBM Resilient as a product, but my company set up the platform so that it can scale for future requirements.

Scalability-wise, my company has some challenges because of the unavailability of experts or lack of the required expertise, so if scalability is part of the initial implementation challenges, that's a five. Still, if it's more of a product capability, then I'm giving IBM Resilient an eight in terms of how scalable it is.

My company raised some tickets with IBM Resilient technical support, and the team gave good responses. The technical support side is okay, but the support from the business side could be better.

Technical support-wise, my rating for IBM Resilient is eight out of ten.

Positive

A SIEM solution has two sides, security information and event management, and in SIEM, implementing the system isn't an issue. However, to get visibility, you must onboard your platforms, so the complexity level for that varies.

Depending on the vendor, a SIEM solution usually has pre-built normalization or passes, but many small customizations will be needed. Onboarding, particularly getting the visibilities, is not a big deal, but you'll face some challenges with the implementation because of the lack of deployment experts. In my part of the world, it's tough to find top-level experts because the experts typically leave and go to other parts of the world. It's a real challenge to retain people in this space. If you're careful and able to manage that challenge, it would be easy to onboard the platforms and implement a SIEM product.

For the SOAR side, the same problem exists, but with a higher level of intensity because SOAR is new to security operations. It's the latest development, so implementing it is a massive challenge because it requires a lot of expertise and experience in different areas of IT operations. SIEM implementation is easier to manage than SOAR implementation.

Implementation would be more straightforward if you have initial awareness or get good training from an experienced team. However, training newbies in the field will be challenging because the newcomers only have product knowledge. Newbies won't know the exact requirements of the IT world or have enough IT experience, so the deployment task should be entrusted to experienced people.

It isn't easy to give a generic or worldwide applicable rating for IBM Resilient because it has a lot of customizations and integrations. Still, based on my experience, I found the initial setup challenging, so it's a five out of ten.

Six months passed, and the implementation for IBM Resilient is still incomplete. It's ongoing, but if you include the time it took to source hardware and other steps, it's more than six months. It's been challenging to gather resources and source hardware because my country is facing a terrible financial crisis. The environment is difficult right now, affecting my rating of IBM Resilient setup-wise, but it's a good product.

My company hired a service partner to implement IBM Resilient, and that service partner works back-to-back with some experts from outside the country. Still, the implementation had some challenges, and it's still ongoing.

It's too early to talk about ROI from IBM Resilient, and it's challenging to compute the ROI without first ensuring that my company has the expertise needed for the product to work.

The licensing cost for IBM Resilient is not too expensive, but it's not affordable, so it's moderately expensive. Regarding price, I'm rating the solution seven out of ten.

The company pays for the license yearly, based on the number of users.

Apart from the cost of the license you need to pay for each user, you also need to spend an initial investment for the base platform. You also have to pay for IBM Resilient support.

My company has not provided IBM Resilient to customers, but it proposed the solution to some. Right now, IBM Resilient is being implemented internally for the company.

My company uses the latest product version.

Based on its features and capabilities, my rating for IBM Resilient is a nine out of ten. Overall, as a solution, it's a nine.

IBM Resilient requires enrollment from different teams in operations, implementation, etc., because the process involves more integrations and customizations. In the current environment, forty to fifty engineers enrolled part-time, with ten people full-time, and then another forty contribute from the operations side. I work in Telco, so the IBM Resilient project is enormous and requires a lot of infrastructure. It's been challenging resource-wise and time-wise.

IBM Resilient, or any SOAR product, can be operated as a standalone product. Right now, my company hasn't observed any capacity limitations because it only has a limited number of users. Eventually, the company will add more users to IBM Resilient when it integrates the solution to the ticketing system that handles many people.

My advice to anyone looking into using IBM Resilient is to find good resources to implement the solution, particularly one with experience in general IT, a product of the same type as IBM Resilient, and he should have some scripting and programming experience, mainly because IBM Resilient runs on Python programming. The implementer should have Python programming experience or at least general programming and scripting experience.

My company is an end user of IBM.

I mainly use it for automating and simplifying incident response workflows, focusing on basic tasks in security orchestration.

IBM Resilient is an okay tool overall, and the most valuable thing about it is how easy it is to navigate the user interface.

I have found IBM Resilient lacking in integration capabilities, which can be frustrating. It is not very straightforward to set up custom integrations, especially with services like Azure. You need an additional server for integration. Also, the custom security features need improvement. Currently, it doesn't work well with many vendors, and there are compatibility issues, like not working with group IP. Also, keeping the platform up-to-date with patches, firewalls, security, and upgrades is crucial to avoid problems with deployments and conversions.

I have been using IBM Resilient for almost three years.

I would rate it a nine out of ten in terms of stability. IBM Resilient is stable, especially for on-premises deployments when set up correctly. It is reliable because it focuses on its core role as a source for incident response without too many extra functions.

I would rate the scalability a seven out of ten because it has a scalable architecture, but there is room for improvement in terms of expanding its capabilities and solutions.

I have had several issues that required contacting the support team. I have had a positive experience with the support team, except when dealing with telecommunications-related issues. The support for customer integrations is decent. I would rate the support a seven out of ten.

Neutral

The initial setup of IBM Resilient is somewhat difficult, particularly in complex environments, as it involves multiple components. It took one day to deploy.

IBM Resilient is relatively affordable. It typically offers a yearly subscription, and I have a three-year license, which is cost-effective.

Overall, I would rate IBM Resilient a seven out of ten. My advice to people who are considering using it is that unless you specifically want to use IBM, there are better alternatives available.