CyberIndexBeta

IBM QRadar EDR

IBMEnterprise Antimalware (primary)Compare with others in Enterprise Antimalware

Product

Endpoint detection and response agent and console (formerly ReaQta) for monitoring endpoints, analysing behaviour and responding to threats. IBM QRadar EDR helps organizations detect, investigate and remediate known and unknown endpoint threats in near real time. Browse report, videos and support documentation to deepen your understanding of IBM QRadar EDR and support informed decision-making. AI-driven automation, attack visualization and alert prioritization reduce analyst workload, accelerate response and support business continuity. Supported platforms are Linux, macOS and Windows.

Current Version
3.12.7
Product Page
ibm.com/products/qradar-edr
Market
Enterprise
Licence
Paid
Price
Quote
Record Created
2026-09-19
Last Updated
2026-10-28

Vendor

IBM's security business is built on operations rather than on endpoint protection: its best-known product is QRadar, the security information and event management platform that many large organisations run their security operations centre on, alongside a substantial consulting and managed services arm and the X-Force research and incident response teams. IBM QRadar EDR, the product listed here, is its endpoint detection and response agent, which came from its 2021 acquisition of the Italian company ReaQta. One thing a buyer should check. In 2024 IBM agreed to sell the QRadar SaaS business to Palo Alto Networks and to migrate those customers onto Cortex XSIAM, which changes the future of the wider QRadar family; the product line listed here should be confirmed as currently sold and supported before it is evaluated. Vendor page →

Website
ibm.com
Country
United States
Headquarters
Armonk, United States
Year Established
1911
Customers
30K organisations
Users
2M devices protected
Revenue
$67.5B (2025)

Platforms

Linuxnative
macOSnative
Windowsnative

Target Market

Enterprise primary

Capabilities

Malware Detectionkeynative
Ransomware Protectionkeynative
Behavioral Detectionkeynative
Web ProtectionkeyNot known
Email ProtectionNot known
Host FirewallNot known
Sandbox AnalysisNot known
Cloud-Assisted ScanningNot known
Heuristic DetectionNot known
Device ControlNot known
Vulnerability ShieldingNot known
Central Management Consolenative

8 of 12 not yet known — not recorded, which is not the same as not supported.

Pricing

PlanLicencePriced perBilledPrice
SummaryPrice on requestnot statedno recurring chargeQuote

Versions

  • 3.12.7Windows
  • 1.2.0macOS
  • 1.0.0Linux

The newest release each source names per platform, not every release the vendor has shipped. A release date is shown only where one is recorded.

Independent Tests

At a glance — latest result per lab test

MITRE ATT&CK Evaluations (Enterprise)

2023-09-20lab report ↗

Each bar is one lab’s own figure on that lab’s own scale. Labs test different models at different times, so the figures are not combined into one score.

MITRE ATT&CK Evaluations (Enterprise)MITRE ATT&CK Evaluations — Enterprise 2023 (Turla)2023-09-20
Technique-level detection: 46.9%Any detection: 72%Attack sub-steps evaluated: 143

Certifications

Not known

Change History

This record was created 2026-09-19. Everything below is what has changed since.

  • 2026-10-28New versionNew version: 1.0.0 (Linux)evidence
  • 2026-10-28New versionNew version: 1.2.0 (macOS)evidence
  • 2026-10-28New versionNew version: 3.12.7 (Windows)evidence
  • 2026-10-28Product updatedVersion no longer recorded: 3.12.26evidence
  • 2026-10-28Product updatedVersion no longer recorded: 3.12.26evidence
  • 2026-10-28Product updatedVersion no longer recorded: 3.12.26evidence
  • 2026-10-12Test result addedNew MITRE ATT&CK Evaluations (Enterprise) resultevidence
  • 2026-09-23Capability addedCentral Management Console: built inevidence
  • 2026-09-23Capability addedBehavioral Detection: built inevidence
  • 2026-09-23Capability addedRansomware Protection: built inevidence
  • 2026-09-23Capability addedMalware Detection: built inevidence
  • 2026-09-22Product updatedListed in Enterprise Antimalwareevidence
  • 2026-09-20Pricing plan addedPrice: price on requestevidence
  • 2026-09-20New versionNew version: 3.12.26 (Windows)evidence
  • 2026-09-20New versionNew version: 3.12.26 (macOS)evidence
  • 2026-09-20New versionNew version: 3.12.26 (Linux)evidence
  • 2026-09-19Platform addedRuns on Windowsevidence
  • 2026-09-19Product updatedSold to: Enterpriseevidence
  • 2026-09-19Platform addedRuns on Linuxevidence
  • 2026-09-19Platform addedRuns on macOSevidence
  • 2026-09-19Product createdNew product listedevidence
Something wrong? Suggest a correction →

May we count your visit? CyberIndex would like to use Google Analytics to see which pages are read. It sets cookies and sends your visit to Google. Decline and nothing is loaded — the site works the same either way. Privacy.