Research supported by one labelled sponsor, with no say over content, rankings or calculations. How sponsorship works
Independent research, supported bycriblCribl Detect: detect, investigate and respond. No lock-in.Sponsor
Vendor / IBM QRadar

IBM QRadar pricing in 2026: EPS tiers, on-prem vs cloud, and enterprise costs

QRadar pricing reference. IBM publishes no list price for QRadar, so this page covers the EPS and FPM licensing model, the one contract price filed on a public marketplace, Community Edition limits, hardware requirements, the end of QRadar on Cloud, and how QRadar sits against Splunk and Sentinel. Pricing surfaces re-verified 13 October 2026.

Page updated 13 October 2026/First published 7 April 2026

Pricing model
Per EPS + FPM
Usage model; MVS for enterprise
IBM list price
Not published
Quoted through IBM sales only
Community Edition
Free, 100 EPS
5,000 flows/min cap
Only filed price
$12,074.40/yr
500 EPS + 10K FPM, AWS Marketplace

How much does IBM QRadar SIEM cost?

IBM does not publish QRadar list pricing. Its own pricing page defines the metrics and then routes you to sales, and the QRadar Suite Software License Guide gives resource-unit ratios with no rates attached. So this page will not show you a per-EPS tier table. What it shows instead is the licensing structure IBM does document, and the single QRadar price that exists on a public surface: the AWS Marketplace listing for IBM Security QRadar Suite Software, where a 12-month contract covering 500 events per second and 10,000 flows per minute is $12,074.40, with QRadar SOAR at $22,704.00 for two authorised users. Everything above that footprint is negotiated, and no public source can tell you what your quote will be.

Understanding EPS pricing

Events Per Second is QRadar's billing meter. An event is any single log entry crossing the QRadar Event Collector. EPS measures rate, not volume; a chatty source with small events drives higher EPS than a quiet source with large events, even at equal GB per day.

QRadar licences a sustained EPS rate (the long-running average) and a peak EPS rate (the burst ceiling). Sustained EPS at 110 percent of licensed for more than 24 hours triggers reconciliation. Peak bursts are smoothed across windows but persistent bursts force a tier upgrade. Right-sizing requires baseline data from a 30-day pilot. Most environments find their first licensing estimate understates real EPS by 30-50 percent.

EPS-to-GB conversion varies by source. Windows event logs average 60-80 EPS per GB per day. Firewalls and NetFlow data run 200-400 EPS per GB. SaaS audit logs run 30-50 EPS per GB. The dominant source mix in your environment defines the conversion ratio.

What IBM licenses, and what is actually priced in public

We used to publish a seven-tier QRadar price table here. It was compiled from reseller and market chatter, no row traced to a vendor source, and the one row we could finally check against a filed price turned out to be roughly double it. So it is gone. Below is what IBM documents, plus the only QRadar figures that exist on a public surface.

ProductLicensed byPublic priceSource
QRadar SIEM (usage model)Events per second (EPS) plus flows per minute (FPM)$12,074.40 / 12 monthsfor 500 EPS and 10,000 FPMAWS Marketplace, IBM Security QRadar Suite Software
QRadar SOARAuthorised users (minimum 2)$22,704.00 / 12 monthsfor 2 authorised usersAWS Marketplace, same listing
QRadar SIEM (enterprise model)Managed virtual servers (MVS), unlimited ingestionNot publishedquoted through IBM sales onlyIBM QRadar SIEM pricing page
QRadar NDRFlows per minute (FPM)Not publishedlicence guide gives ratios, no ratesIBM QRadar Suite Software License Guide
QRadar Community EditionCapped at 100 EPS and 5,000 FPMFree3-month renewable licence, as-is, unsupportedIBM QRadar 101, Community Edition

Verified 7 September 2026 against IBM and AWS Marketplace directly. IBM quotes QRadar through sales on every channel, so there is no list price to report for the enterprise model or for footprints larger than the marketplace contract above. The QRadar Suite Software License Guide does publish the resource-unit ratios behind the metrics (QRadar SIEM 100 EPS to 120 RU, or 1 MVS to 12 RU on the enterprise model; QRadar NDR 10,000 FPM to 300 RU; QRadar SOAR 1 authorised user to 1,000 RU), which lets you compare the relative weight of each product without a rate card. Maintenance, support and negotiated discount levels are set per contract and IBM publishes none of them, so we do not estimate them.

QRadar SaaS to Palo Alto Networks: what changed

Palo Alto Networks closed its acquisition of IBM's QRadar SaaS assets on 4 September 2024, and those products have since reached end of life. Palo Alto's end-of-life summary lists IBM Security QRadar on Cloud, QRadar Suite Cloud-Native SIEM, QRadar Suite SOAR and QRadar Suite Log Insights with an end-of-life date of 14 April 2026, and QRadar Suite EDR, XDR and QRadar Advisor with Watson at 31 August 2026. The migration path offered to those customers is Palo Alto's Cortex XSIAM, with IBM Consulting as a migration partner. Palo Alto states that the announcement does not affect any IBM QRadar on-premise products or SKUs: self-managed QRadar SIEM stays with IBM and is the product IBM's pricing page now sells.

What it means for pricing comparisons: there is no QRadar cloud subscription to price or renew. A buyer who wants QRadar is pricing an on-premise deployment (licence plus hardware and operations); a buyer who wants a cloud-native SIEM is pricing Cortex XSIAM or another vendor. The on-prem licensing structure and the one filed marketplace price on this page are unaffected.

Checked against Palo Alto Networks' end-of-life summary and IBM's QRadar SIEM pricing page on 13 October 2026. Verify the current status directly with IBM and Palo Alto before committing.

On-prem hardware requirements

For self-managed QRadar deployments, expect IBM-spec or equivalent hardware with the following rough configurations. The cost column is our own estimate of general server and storage cost for the specs described, with no published source behind it; it is not an IBM price, and it is separate from whatever IBM quotes you for the licence.

DeploymentHardwareCost
All-in-one (under 1,000 EPS)Single appliance / VM, 32GB RAM, 2TB storage$38K-$60K
Distributed (1,000-5,000 EPS)Console + 2 collectors, 64-128GB RAM each, 10-20TB total$80K-$160K
Enterprise (5,000-15,000 EPS)HA console, 4+ collectors, 256GB RAM, 50TB+ tiered storage$200K-$400K
Large enterprise (25,000+ EPS)Multi-site, dedicated event processors, 100TB+$500K-$1.2M

What drives QRadar cost at each scale

Since IBM publishes no rates above the marketplace contract, the useful thing to know going into a quote is which lines will be on it. These are the cost drivers by deployment shape, not price predictions.

ScenarioProfileCost drivers on the quoteNotes
StartupCommunity Edition, 100 EPSNone (free licence)Free, capped at 100 EPS and 5,000 flows/min; renewable 3-month licence, unsupported, learning only
Small businessAround 500 EPS, single-nodeLicence units, appliance or VM, storage retentionThe one publicly filed QRadar SIEM price covers this footprint: 500 EPS and 10,000 FPM
Mid-marketLow thousands of EPS, virtual appliancesLicence units, retention tier, add-on modules, VM infrastructureCloud-delivered QRadar is no longer sold (QRadar on Cloud reached end of life 14 April 2026); this footprint is self-managed on VMs or appliances
EnterpriseFive figures of EPS, hybridLicence units, distributed collectors, HA, professional servicesDistributed deployment; deployment services are usually a separate contract
Large enterpriseMulti-site, dedicated event processorsLicence units, multi-site hardware, UBA and threat-intel add-onsNegotiated enterprise agreement; IBM publishes no rate card at this scale
FAQ

Common questions

How much does IBM QRadar cost?

IBM does not publish QRadar list pricing. Its own QRadar SIEM pricing page defines the licensing metrics (events per second and flows per minute for the usage model, managed virtual servers for the enterprise model) and then routes buyers to a sales conversation, and the QRadar Suite Software License Guide gives resource-unit ratios with no rates attached. The one QRadar price filed on a public surface is the AWS Marketplace listing for IBM Security QRadar Suite Software, where a 12-month contract covering 500 events per second and 10,000 flows per minute is listed at $12,074.40, and QRadar SOAR for 2 authorised users at $22,704.00. Anything beyond that footprint is quoted, so we do not publish a tier table. Treat any per-EPS figure you find elsewhere as a third-party estimate rather than an IBM rate.

What is the QRadar Community Edition?

QRadar Community Edition (QRadar CE) is a free, single-node version of QRadar capped at 100 EPS and 5,000 flows per minute, issued as a renewable three-month licence. IBM provides it as-is, without warranty or support. It includes the core SIEM features but excludes premium add-ons like User Behavior Analytics, X-Force Threat Intelligence feeds, and the QRadar Vulnerability Manager. Community Edition is intended for learning, testing, and very small environments. Production deployments need a paid licence.

How do I estimate EPS from log volume?

Rough conversions vary by log source type. Text-heavy sources (Windows event logs, syslog) average 60-80 EPS per GB per day. Compact sources (firewall logs, NetFlow) can reach 200-400 EPS per GB. As a rule of thumb, 1 GB per day of mixed enterprise log volume equates to roughly 70 EPS sustained, with bursts to 2-3x peak. QRadar measures both sustained and peak EPS; consistently exceeding the licensed peak triggers reconciliation.

QRadar on Cloud or on-premise?

On-premise is now the only QRadar IBM sells. QRadar on Cloud, the cloud-native QRadar Suite SIEM, QRadar Suite SOAR and QRadar Suite Log Insights were sold to Palo Alto Networks in 2024 and reached end of life on 14 April 2026 (Palo Alto's end-of-life summary lists them; the QRadar Suite EDR, XDR and Advisor with Watson lines follow on 31 August 2026). Palo Alto's migration path for those customers is Cortex XSIAM. IBM's own QRadar SIEM pricing page lists on-premise appliances, virtual deployments and the X-Force managed service, with no cloud option. So the choice is between self-managed QRadar, with the hardware and operations cost that carries, and a different cloud-native SIEM; there is no QRadar on Cloud to renew.

QRadar vs Splunk vs Sentinel cost at equivalent volume?

This one cannot be answered on a like-for-like price line, and we will not pretend otherwise. At 50 GB per day, Splunk Cloud lists at about $63K base ingest (about $124K once Enterprise Security is added) and Sentinel at $59K-$78K (50 GB promotional commit vs PAYG), because both vendors' rates are public (Splunk's through its UK G-Cloud 15 filing and AWS Marketplace listing). IBM publishes none for QRadar, so the only public QRadar reference point is the AWS Marketplace contract at 500 EPS and 10,000 FPM, a much smaller footprint than 50 GB per day, and it cannot be scaled up to a comparable number without inventing a discount curve. Get a quote from IBM and put it beside the published Splunk and Sentinel rates yourself. On non-price grounds, QRadar's appeal is compliance content packs and out-of-box detection rules for regulated industries, Splunk wins on raw analytics depth, and Sentinel wins on Microsoft-shop TCO.
Continue reading

Related cost references

Splunk pricing
Per-GB alternative
Microsoft Sentinel pricing
Cloud-native alternative
Pricing models explained
Per-EPS vs per-GB
Cloud vs on-premise SIEM
QRadar's strongest tradeoff
Implementation cost
QRadar deployment timeline
SIEM cost calculator
Compare side by side

Didn't find your answer?

Ask us. A real person reads every question and we answer the ones we can, with sources. If your question would help other readers, we may publish an anonymised version, with your permission. General reference only.

Ask a question

questions@siemcostcalculator.com