In 2024 IBM sold its QRadar SaaS business to Palo Alto Networks, which offers those customers a move to Cortex XSIAM. IBM continues to sell and support QRadar SIEM for on-premises use. For many QRadar teams that was the moment to review the SIEM choice anyway: licences based on events per second, AQL skills that are hard to hire for, and appliances that are due for renewal.
This comparison is for teams in that position. We look at deployment model (cloud or your own data centre), pricing, how much detection content you get and where the data falls legally.
Why teams look for a QRadar alternative
- Roadmap uncertainty after the sale of QRadar SaaS to Palo Alto Networks.
- Licensing by events per second (EPS) and flows per minute makes growth expensive.
- Appliance renewals and on-premises upgrades take time and budget.
- AQL and DSM tuning skills are scarce.
The alternatives
1. LogPulse
Managed SIEM and log management, hosted at Scaleway in Amsterdam, or fully on-premises on Enterprise (OpenShift, Kubernetes or Red Hat Enterprise Linux, including air-gapped). Over 690 tested Detection Hub rules mapped to MITRE ATT&CK, risk-based alerting, Sigma import and an AI Investigator. Flat pricing per plan, not per EPS.
Best for: European QRadar customers who want a modern SIEM in the cloud or in their own data centre.
2. Palo Alto Cortex XSIAM
The migration path Palo Alto Networks offers QRadar SaaS customers: SIEM, SOAR and XDR in one platform with heavy automation. Strongest in a Palo Alto estate.
Best for: Organisations already standardised on Palo Alto Networks.
3. Microsoft Sentinel
Cloud SIEM on Azure with KQL, no infrastructure to run. Metered per GB plus retention and automation.
Best for: Microsoft-centric organisations.
4. Splunk Enterprise Security
Mature SIEM with a huge ecosystem, cloud or on-premises. Typically the most expensive option at volume.
Best for: Large SOCs with Splunk skills and budget.
5. Elastic Security
SIEM on the Elastic Stack, self-hosted or cloud, with a public rule repository.
Best for: Teams with Elasticsearch expertise.
6. Google Security Operations
Cloud SIEM from Google with long retention and YARA-L detections, priced per contract.
Best for: Large organisations on Google Cloud.
Side-by-side comparison
| Alternative | Deployment | Pricing model | On-premises possible | Company jurisdiction |
|---|---|---|---|---|
| LogPulse | SaaS or dedicated stack | Flat per plan | Yes (Enterprise) | EU (Netherlands) |
| IBM QRadar SIEM | On-premises | EPS / FPM | Yes | US |
| Cortex XSIAM | Cloud | Contract | No | US |
| Microsoft Sentinel | Cloud (Azure) | Per GB + meters | No | US |
| Splunk ES | Cloud or on-prem | Ingest / workload | Yes | US (Cisco) |
| Elastic Security | Cloud or self-hosted | Resource / usage | Yes | US / NL |
| Google SecOps | Cloud | Contract | No | US |