QRadar customers now face two different futures: the SaaS products IBM sold to Palo Alto Networks have reached or are reaching end of life, while QRadar on premises continues under IBM with a new 7.6 release and its own component retirements. Confusion between the two has led some teams to plan a rushed replacement they did not need, and others to miss a shutdown that removed their detection platform. This guide sets out the official dates, works out which estate you have, and covers the QRadar-specific migration work: AQL and rule translation, log source and DSM mapping, reference data, offences and the service accounts that feed the SIEM. It is for SOC leads, detection engineers and security architects running QRadar. The generic method (discovery, pipeline design, parallel running) is in the SIEM Migration Guide and is not repeated here.
This is an independent guide from NHI Mgmt Group, based on IBM's public documentation as of November 2026. It is not sponsored or reviewed by IBM. Product features change, so confirm settings against IBM's current documentation.
Key takeaways
- SaaS and on premises are separate tracks. Palo Alto Networks' end-of-life summary lists QRadar on Cloud, Cloud-Native SIEM, SOAR and Log Insights at 14 April 2026, and QRadar Suite EDR, XDR and Advisor with Watson at 31 August 2026, and states that QRadar on-premise products are not affected.
- On premises continues. At the 2024 deal close, Palo Alto Networks stated that on-premises customers would keep receiving IBM support and updates, and IBM's lifecycle page lists QRadar SIEM 7.6.0, generally available on 30 June 2026, as a current release.
- Some on-premises components are retiring. IBM lists end of support on 30 April 2026 for QRadar Incident Forensics, QRadar Log Manager, Log Manager High Availability and Disaster Recovery, and Network Packet Capture software, so check every module you license.
- Rules do not translate automatically. AQL functions such as
LOGSOURCENAME,QIDNAMEandREFERENCESETCONTAINSdepend on QRadar's QID map, DSMs and reference data, so every target needs those concepts rebuilt, not just the query syntax. - Inventory the identities feeding QRadar. Log collection accounts, API tokens for apps and SOAR, and cloud credentials used by protocols are long-lived non-human identities that must be rotated or retired with the platform.
What is changing and why
In 2024 IBM and Palo Alto Networks agreed a partnership under which Palo Alto Networks acquired IBM's QRadar SaaS assets. Palo Alto Networks announced that it had closed the acquisition on 4 September 2024. Its press release said QRadar SaaS customers would keep uninterrupted service and support until they were ready to move to Cortex XSIAM, that eligible customers could receive no-cost migration services through IBM Consulting, and that customers staying on QRadar on premises would continue to receive IBM support and updates, including security fixes, critical bug fixes and connector updates.
IBM's lifecycle notice for the divested EDR offering records it as withdrawn from marketing and divested on 5 September 2024, and notes a Palo Alto Networks end-of-life announcement on 14 April 2025 covering the acquired QRadar SaaS products. For these as-a-service offerings IBM states that support ends when the cloud service ends and that extended and sustained support are not available.
| Product line | Owner now | Status as published |
|---|---|---|
| QRadar on Cloud (QRoC), QRadar Suite Cloud-Native SIEM, Log Insights | Palo Alto Networks | End of life 14 April 2026 |
| QRadar Suite SOAR, IBM Security SOAR on Cloud, SOAR portion of Cloud Pak for Security as a Service | Palo Alto Networks | End of life 14 April 2026 |
| QRadar Suite EDR and XDR, QRadar Advisor with Watson, X-Force Threat Intelligence | Palo Alto Networks | End of life 31 August 2026 |
| QRadar SIEM on premises 7.5 | IBM | Current patched release, continuous delivery via update packs |
| QRadar SIEM on premises 7.6.0 | IBM | GA 30 June 2026, Support Cycle 5 (SC-5) lifecycle |
| QRadar Incident Forensics, Log Manager, Log Manager HA and DR | IBM | End of support 30 April 2026; extended or sustained support to 30 April 2030 |
| QRadar Network Packet Capture software | IBM | End of support 30 April 2026, no extension listed |
| QRadar Network Insights Appliance 1940 G2 | IBM | Withdrawn from market 31 December 2026; transition to and completion of extended or sustained support 31 December 2030 |
Official timeline and current status
| Date | Event | Source |
|---|---|---|
| 4 September 2024 | Palo Alto Networks closes the acquisition | Palo Alto Networks press release, SEC Form 8-K exhibit 99.1 |
| 5 September 2024 | QRadar Suite EDR withdrawn from marketing by IBM and divested | IBM lifecycle notice |
| 14 April 2025 | Palo Alto Networks end-of-life announcement for acquired QRadar SaaS products | IBM lifecycle notice |
| 14 April 2026 | End of life: QRoC, Cloud-Native SIEM, SOAR SaaS, Log Insights | Palo Alto Networks end-of-life summary |
| 30 April 2026 | End of support: Incident Forensics, Log Manager, Log Manager HA and DR, Network Packet Capture software | IBM QRadar support lifecycle |
| 12 May 2026 | IBM announces QRadar 7.6.0 under the SC-5 lifecycle | IBM QRadar support lifecycle |
| 30 June 2026 | QRadar SIEM 7.6.0 generally available | IBM QRadar support lifecycle |
| 31 August 2026 | End of life: QRadar Suite EDR, XDR, Advisor with Watson | Palo Alto Networks end-of-life summary |
| 31 December 2026 | Network Insights Appliance 1940 G2 withdrawn | IBM lifecycle notice |
Status as checked on 8 November 2026: all listed QRadar SaaS products have passed their published end-of-life dates. QRadar SIEM on premises has no announced end-of-support date for 7.5 or 7.6 on IBM's lifecycle page. IBM states that 7.6.0.1 is the recommended minimum upgrade target for customers on 7.5.0 UP10 to UP15, and customers on UP16 or later should check the release notes. Lifecycle pages change: recheck them before committing a plan.
Who and what is affected
- Former QRadar SaaS tenants: any organisation that has not completed a move off QRoC, Cloud-Native SIEM or Log Insights has lost the service. Priority is restoring detection and confirming what log history was exported.
- SOAR SaaS users: playbooks, integrations and case history in QRadar SOAR on Cloud ended on 14 April 2026, which also breaks any SIEM to SOAR escalation built on it.
- On-premises customers on 7.5: not forced to move, but facing an upgrade to 7.6 and the retirement of modules such as Log Manager, Incident Forensics and Log Manager HA or DR. A Log Manager deployment that relies on HA for resilience needs a plan for after 30 April 2026 support ends.
- Hardware owners: appliances follow their own five-year lifecycles from purchase or end of marketing, so an estate can be supported in software but running on hardware past its end of support.
- Integrations: QRadar apps, the REST API consumers, ticketing and threat intelligence feeds, and anything that queries Ariel or receives offences.
Finding affected systems and identities
- Licensed modules and versions: list every QRadar component, version and update pack, and every appliance with its machine type and serial, and check each against IBM's lifecycle page.
- Log sources: export log sources with their log source type (DSM), protocol, target event collector, events per second and last event time. Dormant log sources should be dropped, not migrated.
- Content: export custom rules, building blocks, saved searches, reports, custom event properties, custom QID mappings and reference sets, maps and tables. Record which rules generated offences in the last 90 days.
- Query dependencies: search saved AQL and app code for QRadar-specific functions. IBM documents functions including
LOGSOURCENAME,LOGSOURCETYPENAME,QIDNAME,CATEGORYNAME,RULENAME,INOFFENSE,REFERENCEMAP,REFERENCETABLE,REFERENCESETCONTAINSandASSETHOSTNAME. Each marks a dependency that has no direct equivalent elsewhere. - Identities: list the accounts QRadar uses to pull logs (Windows event collection accounts, database and syslog-over-TLS credentials, cloud API keys and IAM roles for protocols such as cloud log polling), the API tokens issued to apps and integrations, and the human admin accounts and their roles.
- Consumers: list who receives offences and reports, including the SOC queue, managed service providers, compliance reporting and any audit evidence pulled from QRadar.
A Log Source Coverage Matrix Template helps turn the log source export into a coverage view against ATT&CK before you decide what to rebuild.
Migration options
| Option | Fits when | Main work |
|---|---|---|
| Stay on premises and upgrade to 7.6 | QRadar works well, data must stay on site, budget favours continuity | Upgrade path from your update pack, replace retiring modules (HA, DR, Log Manager, Incident Forensics), refresh appliances |
| Cortex XSIAM (the path announced for SaaS customers) | Former SaaS tenant or strategic move to the acquirer's platform | Data onboarding, query rewrite to XQL, rebuild of correlation and automation content |
| Another cloud or on-premises SIEM | Different platform strategy or licensing model | Same translation and mapping work; run a structured evaluation. See the SIEM Buyer's Guide. |
| Managed detection service | Small team, no appetite to run a SIEM | Contract scope, log forwarding, who owns detections and retention |
Translating QRadar content
| QRadar concept | What it depends on | Migration approach |
|---|---|---|
| DSM and log source type | QRadar parsing and normalisation per product | Map each DSM to the target's parser or data model; test parsing on sample events |
| QID and low-level or high-level category | QRadar's event taxonomy; QIDNAME, CATEGORYNAME | Replace with source-native event IDs or the target schema's fields; never keep QIDs as magic numbers |
| Custom event properties | Regex or JSON extraction on payloads | Rebuild as parsing rules; confirm field names before rewriting rules |
| Rules and building blocks | Rule tests, thresholds, building block references | Express the intent as a vendor-neutral rule, for example Sigma, then compile to the target. See the Sigma Rules Guide. |
| Reference sets, maps and tables | Watchlists maintained by rules or feeds | Recreate as lookup tables; move the feeds and the rules that populate them |
| Offences | QRadar's grouping of events into incidents | Map to the target's incident or case model and the escalation route to SOAR or ticketing |
| AQL saved searches and reports | Ariel events and flows tables | Rewrite queries against the new schema; validate result counts on the same time window |
Do not rely on automatic translators for AQL. Palo Alto Networks documents a beta Translate to XQL feature in Cortex XSIAM for Splunk SPL only, and states that not all queries can be converted, so plan for engineering time on every rule you keep.
Testing and rollback
- Cut scope first: keep rules that fired usefully or map to a priority ATT&CK technique; retire the rest. Fewer rules translated well beat many translated badly.
- Dual-feed critical sources: send identity, endpoint, cloud control plane and firewall logs to both QRadar (on premises) and the target while you validate.
- Validate parsing: compare field extraction for a sample of each log source type before testing any rule.
- Validate detections: replay or emulate the behaviour each rule targets and confirm both platforms alert. Compare counts for the same window to find gaps.
- Cut over by use case: move the SOC queue for one domain at a time and keep the other platform as the reference.
- Rollback: on-premises customers can keep QRadar as the system of record until the target is proven. Former SaaS tenants have no rollback, so the fallback is the raw log archive and the new platform.
- Retire cleanly: export the history you must retain, revoke QRadar API tokens, disable or rotate collection credentials, and decommission appliances with media sanitisation.
Risks of doing nothing
- Detection gap: a SaaS tenant past end of life has no SIEM. For on-premises estates, running retired HA or DR modules without support weakens the resilience the SOC depends on.
- Retention and audit failures: logs required for regulation or investigations may be lost if history was not exported before the service ended.
- Orphaned credentials: collection accounts with domain read rights, cloud API keys and API tokens remain valid after the SIEM goes, giving an attacker long-lived access nobody monitors. See the Detection Engineering for Non-Human Identities Guide.
- Unsupported hardware: appliances past hardware end of support carry firmware and component risk even when the software is current.
- Rushed migrations: on-premises customers who assume QRadar is "end of life" may migrate without the scoping and validation that keep detections working.
Framework mapping
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Lifecycle tracking of SIEM components and appliances | ID.AM-08, PR.PS-02 | SA-22, CM-8 |
| Log source coverage and collection | DE.CM-01, DE.CM-09 | AU-2, AU-12 |
| Detection rules and offence handling | DE.AE-02 | SI-4, AU-6 |
| Collection accounts and API tokens | PR.AA-01 | IA-5, AC-2 |
| Continuity during cutover | ID.IM-01 | CP-2, CM-3 |
Practitioner checklist
- Confirm whether each QRadar component you run is SaaS (Palo Alto Networks end of life) or on premises (IBM lifecycle).
- Check every module, appliance and update pack against IBM's lifecycle page and plan the 7.6.0.1 upgrade path if staying.
- Export log sources with DSM, protocol, volume and last event time, and drop dormant sources.
- Export rules, building blocks, reference data, custom properties and saved AQL, and record which rules produced useful offences.
- Rewrite kept rules as vendor-neutral logic first, then implement and validate on the target.
- Inventory and rotate or revoke every collection credential and API token tied to QRadar.
- Export retained log history and evidence before any service or appliance is switched off.
- Keep a dated note of the lifecycle pages checked and recheck them each quarter.
Standards and references
- IBM Support: IBM QRadar Support Lifecycle
- Palo Alto Networks: End-of-Life Summary
- Palo Alto Networks (SEC filing): Palo Alto Networks Closes Acquisition of IBM's QRadar SaaS Assets
- IBM Support: QRadar Suite EDR (SaaS) lifecycle notice
- IBM Support: QRadar Network Insights Appliance 1940 G2 lifecycle notice
- IBM Documentation: AQL data retrieval functions
- Palo Alto Networks: Cortex XSIAM Translate to XQL
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: SIEM Migration Guide · SIEM Buyer's Guide · Sigma Rules Guide · Detection as Code Guide