QRadar

Stands for: IBM QRadar (originally Q1 Labs QRadar), security information and event management

The security intelligence platform Q1 Labs built in Fredericton, sold to IBM in 2011, and split in 2024 between IBM, which kept the on-premises product, and Palo Alto Networks, which bought the SaaS version.

QRadar began as the product of Q1 Labs, a 2001 spinout from the University of New Brunswick that had moved to Waltham, Massachusetts by 2011. The trade press of the day described it as log, threat and compliance management with flow and event processors that read network and security events and application flow data: in later vocabulary, a SIEM with a strong flow side, sold to 1,800 clients. IBM announced the purchase on 4 October 2011, closed it on 26 October and made Q1 Labs' chief executive the general manager of a new Security Systems division. On 4 September 2024 Palo Alto Networks completed its acquisition of the QRadar SaaS assets, offering free migration to Cortex XSIAM, while QRadar on premises stayed with IBM and keeps receiving its features and fixes. One product name, two owners, two roads.

What the product did, in the words of 2011. TechCrunch described Q1 Labs' QRadar as log, threat and compliance management solutions, with flow and event processors for processing network and security events and network and application flow data. That sentence is a fair summary of what a security information and event management system was expected to do then and still is: collect logs from everything, normalise them, correlate events across sources, and raise the ones that matter as offences for an analyst. The flow side was QRadar's distinguishing habit, because Q1 Labs had come at the problem from network behaviour rather than from the log archive, and the product kept a native view of who talked to whom alongside the event stream.

The company. Q1 Labs was founded in Fredericton, New Brunswick, in 2001 as a spinout from the University of New Brunswick; by the time of the sale it was based in Waltham, Massachusetts, with a strong presence still in Fredericton. IBM announced the acquisition on 4 October 2011 with financial terms undisclosed and closed it on 26 October 2011; Brendan Hannigan, Q1 Labs' chief executive, became general manager of IBM's newly formed Security Systems Division. Buying a company to found a division is a different act from buying a product to fill a gap, and the division's name told the market which it was.

The split. On 4 September 2024 Palo Alto Networks announced from Santa Clara that it had completed the acquisition of IBM's QRadar Software as a Service assets. The release draws the line precisely: QRadar clients who wish to remain on QRadar on premises continue to receive IBM features and support, including security, usability and critical bug fixes, updates to existing connectors and the ability to expand consumption; eligible SaaS customers are offered free migration services, with IBM Consulting, to the Cortex XSIAM platform; and IBM acts as a preferred managed security services provider for the shift. Read practically, the cloud product became an on-ramp into a competitor's platform and the on-premises product became an installed base in maintenance.

Why it is on this glossary. The author's generation of network engineers met QRadar as the console into which their firewall and switch logs disappeared, and the one that produced the offence ticket at three in the morning. Knowing which owner now holds which half matters when a customer asks what to do with a QRadar estate, and the answer differs for the two halves. The companion record on the industry timeline carries the sources and dates.

Also known as: ibm qradar, q1 labs qradar, qradar siem, qradar saas

Sources

← All glossary entries