Palo Alto Networks Bought IBM’s QRadar SaaS Assets. What Customers Need to Know Before EOL

The headline “Palo Alto Networks to acquire IBM QRadar assets” is no longer current. Palo Alto Networks announced the deal on May 15, 2024, completed it on August 31, 2024, and paid approximately $500 million for selected IBM QRadar software-as-a-service assets. The transaction did not include IBM’s entire QRadar portfolio or automatically transfer every on-premise QRadar customer.

The immediate issue for affected customers is migration. Palo Alto Networks has been retiring the acquired QRadar SaaS products on a staged schedule, with Cortex XSIAM positioned as the preferred destination for eligible customers. The broader deal also illustrates how the security-information and event-management (SIEM) market is consolidating into larger security-operations platforms.

#	Preview	Product	Price
1		Network Security, Firewalls, and VPNs	$66.62	Buy on Amazon
2		Network Security, Firewalls, and VPNs: . (Issa)	$57.99	Buy on Amazon
3		TP-Link ER605, Wired Gigabit VPN Router	$49.99	Buy on Amazon
4		Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid	$33.20	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What Palo Alto Networks actually acquired

Palo Alto Networks acquired selected IBM QRadar SaaS assets, not “QRadar” in its entirety. According to Palo Alto Networks’ SEC filing, the assets included certain intellectual-property rights, customer relationships, and SaaS customer contracts. IBM also agreed to provide transition services through the fiscal quarter ending in October 2026.

The announced purchase price was approximately $500 million. The original transaction announcement described the financial terms as undisclosed; the approximate price was reported in IBM’s investor announcement. (IBM investor announcement; Palo Alto Networks SEC filing)

#1 Best Overall

Sale

Network Security, Firewalls, and VPNs

$66.62

Buy on Amazon

That distinction matters. The deal was not a blanket acquisition of:

• Every IBM QRadar product or software license;
• Every QRadar appliance or on-premise deployment;
• Every IBM customer contract; or
• IBM’s entire security-operations business.

IBM’s original announcement separately addressed on-premise customers, saying those customers could continue receiving IBM features and support if they remained on QRadar on-premise. (Joint announcement)

QRadar SaaS customers face a migration, not a product preservation plan

The commercial purpose of the transaction was to move eligible QRadar SaaS customers toward Palo Alto Networks’ Cortex security-operations products, particularly Cortex XSIAM. IBM Consulting was named a preferred migration and services partner, and some eligible customers were offered no-cost migration services under applicable terms. (Closing announcement)

“No-cost migration services” should not be confused with free replacement software. Customers still need to establish the commercial cost of the new platform, data retention, endpoint coverage, cloud and network telemetry, professional services, and any managed security services.

Palo Alto Networks’ support policy says valid QRadar SaaS subscriptions would continue through the earlier of the applicable subscription term or the relevant end-of-life date, followed by six months of technical assistance after the subscription term to support migration. Customers should verify the exact terms in their contracts rather than relying on a general announcement. (Palo Alto Networks end-of-life policy)

Rank #2

Sale

Network Security, Firewalls, and VPNs: . (Issa)

• Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
• New Chapter on detailing network topologies
• The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
• Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
• Increased coverage on device implantation and configuration

$57.99

Buy on Amazon

Key QRadar SaaS end-of-life dates

End of sale and end of life are different events. Palo Alto Networks announced the end of sale and end of life for the acquired SaaS portfolio on April 14, 2025. The listed product-specific dates are:

As of the August 16, 2026 editorial snapshot, the first group had already reached its listed end-of-life date and the second group was scheduled to reach end of life on August 31, 2026. The notice does not mean that every QRadar product ends on that date. Palo Alto Networks expressly says the announcement does not affect IBM QRadar on-premise products or SKUs. (End-of-sale notice; QRadar acquisition overview)

What happens to different types of QRadar customers?

QRadar SaaS customers

These customers are most directly affected. Their work includes selecting a replacement, converting detections and playbooks, exporting historical data, validating integrations, and negotiating the commercial terms of the transition.

QRadar on-premise customers

On-premise customers should not assume that the SaaS EOL schedule applies to them. IBM’s 2024 announcement said IBM would continue providing support and updates for customers remaining on QRadar on-premise, while Palo Alto Networks’ EOL information excludes IBM QRadar on-premise products and SKUs.

Each organization should check its specific IBM SKU, version, appliance, support contract, and IBM product-lifecycle notice. “QRadar on-premise” is not a single contractual category.

Rank #3

Sale

TP-Link ER605, Wired Gigabit VPN Router

• 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
• 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
• 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
• 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
• Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q

$49.99

Buy on Amazon

QRadar Suite and mixed-component customers

Suites may contain several security functions with different lifecycle treatment. A customer should map each component separately, including SIEM, SOAR, EDR, XDR, Log Insights, Randori, X-Force, and Advisor products. Do not assume that an entire suite has one uniform end date or that unaffected IBM components disappear with an affected SaaS SKU.

IBM Consulting customers

IBM’s continuing role may make the transition easier for customers that already use IBM Consulting, but it also raises a concentration question. A customer may be moving from IBM’s product ecosystem into Palo Alto Networks’ platform ecosystem through IBM’s services arm. Ask for a separate statement of work covering discovery, conversion, testing, cutover, archiving, and post-migration support.

Why Palo Alto Networks wanted the assets

Palo Alto Networks said the transaction would accelerate growth in its Cortex Security Operations business. The acquired customer relationships and SaaS contracts gave the company a large installed base that could be introduced to Cortex XSIAM and related products. Its SEC filing attributed goodwill primarily to expected synergies and increased market penetration. (Palo Alto Networks SEC filing)

The strategic logic has several parts:

• Grow Cortex Security Operations more quickly;
• Combine SIEM capabilities with endpoint, network, cloud, XDR, SOAR, and threat-prevention products;
• Use IBM’s enterprise relationships and consulting capacity to support migration; and
• Replace a standalone SaaS relationship with a broader security-platform relationship.

A skeptical interpretation is that the transaction was also a customer-retention and customer-conversion strategy: Palo Alto Networks obtained access to QRadar SaaS customers while IBM reduced its direct exposure to a cloud SIEM product. That is an inference from the asset scope, migration plan, and EOL schedule—not an admission by either company.

Why Cortex XSIAM is not a drop-in QRadar replacement

Palo Alto Networks positions Cortex XSIAM as a broader security-operations platform that combines SIEM, SOAR, attack-surface management, XDR, endpoint, and other capabilities. The company cited 3,000 out-of-the-box detectors in its original announcement; that is a Palo Alto Networks claim, not an independently audited feature comparison with QRadar. (Original announcement)

Rank #4

Sale

Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid

$33.20

Buy on Amazon

The migration question is therefore not simply whether QRadar rules can be imported. Buyers should test:

• Conversion of custom rules, offenses, reference sets, and custom properties;
• Replacement of dashboards, reports, APIs, and compliance workflows;
• Recreation of SOAR playbooks and third-party integrations;
• Historical-data export, retention, searchability, and chain of custody;
• Required endpoint, network, cloud, and identity telemetry;
• Analyst workflows and training requirements; and
• Licensing changes caused by adding agents, sensors, storage, or data sources.

Other vendors are competing on migration as well as product capability. Microsoft advertises an AI-assisted tool for converting QRadar alerts into native Microsoft Sentinel detections. That can reduce translation effort, but it does not prove that every custom detection or operational workflow will transfer without redesign. (Microsoft Sentinel)

The SIEM market is consolidating

This deal was part of a larger 2024 shift. Cisco completed its $28 billion Splunk acquisition on March 18, 2024, and Exabeam and LogRhythm completed their merger on July 17, 2024. Cisco describes the Splunk combination around network, security, and observability capabilities, while Exabeam describes its merger as combining cloud-native analytics with SIEM and data-management capabilities. (Cisco; Exabeam)

The direction of travel is from standalone SIEM products toward integrated security-operations platforms that combine SIEM, XDR, SOAR, endpoint, cloud, automation, and threat intelligence. That does not mean demand for SIEM is shrinking. An IDC estimate reproduced in a Splunk-hosted report put 2023 SIEM revenue at approximately $6.23 billion. The figures are historical estimates, not current 2026 market shares. (IDC report)

Consolidation can reduce the number of tools, simplify procurement, and improve telemetry integration. It can also increase vendor lock-in, make pricing harder to benchmark, and force security teams to adopt a platform’s preferred architecture.

How affected customers should evaluate replacement options

There is no universal public price for Cortex XSIAM, Splunk, Google SecOps, or Exabeam in the supplied material. Microsoft describes Sentinel pricing around data ingested, stored, and consumed and advertises promotions that can change by region and date. Require written quotes and compare the full bill of materials, not just a headline subscription rate.

QRadar migration checklist

1. Identify the exact deployment: SaaS, QRadar on Cloud, QRadar Suite, or on-premise.
2. Map every SKU and component: Include SIEM, SOAR, EDR, XDR, Log Insights, Randori, X-Force, and Advisor.
3. Confirm dates in writing: Check the contract term, applicable EOL date, support period, and data-access terms.
4. Request migration eligibility: Clarify what “no-cost” services include and exclude.
5. Inventory content: Export detections, custom properties, reference sets, dashboards, reports, playbooks, APIs, and integrations.
6. Validate historical data: Confirm export format, retention, searchability, compliance archives, and chain of custody.
7. Run a proof of concept: Test representative detections, false-positive handling, investigations, reporting, and response workflows.
8. Compare total cost: Include ingestion, storage, agents, sensors, services, retraining, parallel operations, and archive costs.
9. Negotiate transition terms: Define credits, migration deliverables, parallel-run access, escalation paths, and post-cutover support.
10. Document rollback and final support: Maintain an incident-response plan and record the final date on which each legacy service is supported.

Bottom line

Palo Alto Networks did not simply buy “QRadar.” It bought selected IBM QRadar SaaS assets and customer relationships, then used the transaction to accelerate migration toward Cortex XSIAM and the wider Cortex platform. QRadar SaaS customers should treat the deal as a lifecycle and replacement decision. On-premise QRadar customers should not assume that the SaaS EOL schedule applies to them. The right replacement depends on ecosystem fit, functional continuity, data requirements, and total cost—not on the vendor’s migration narrative alone.

Quick Recap

SaleBestseller No. 1

Network Security, Firewalls, and VPNs

$66.62

SaleBestseller No. 2

Network Security, Firewalls, and VPNs: . (Issa)

New Chapter on detailing network topologies; Increased coverage on device implantation and configuration

$57.99

SaleBestseller No. 3

TP-Link ER605, Wired Gigabit VPN Router

$49.99

SaleBestseller No. 4

Cybersecurity for Small Networks: A Guide for the Reasonably Paranoid

$33.20

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.