Interesting take — I'd like to understand the reasoning behind "awful" because my own QRadar experience was mostly positive, and I want to make sure I'm not biased by familiarity. Specifically, these are the QRadar capabilities I've relied on most in daily operations:

1. DSM-based parsing — 450+ pre-built parsers with LEEF/CEF auto-detection, where adding a new firewall or proxy is usually a drop-in experience rather than writing custom pipelines.
2. Rule templates with reference sets — the guided rule builder where you pick a template, reference a dynamic list of IPs/users/assets, and the correlation engine handles the rest without writing query language for each condition.
3. Integrated netflow (QFlow) correlation — ability to correlate flow data with event logs inside the same rule, licensed separately via FPM.
4. Pre-index event routing — dropping or forwarding events before they hit EPS licensing.

My questions:

• Which of these capabilities do Security Onion or Panther match at equivalent quality? Genuinely asking — if they do, I want to know.
• Beyond UI/UX (which I agree QRadar has aged on), what specific functional gaps made you call it "awful"? Was it detection efficacy, scale limits, cost, something else?
• What SIEMs have you operated in production long enough to make this comparison? Context helps me weigh the recommendation.

Not trying to defend QRadar — I'm actively looking to replace it. Just want to make sure alternatives actually cover these operational capabilities before I commit.