NetWitness NDR provides robust network security features, offering full visibility and effective incident response. Its seamless integration and user-friendly interface support malware detection and real-time threat tracking.
| Product | Mindshare (%) |
|---|---|
| NetWitness NDR | 3.4% |
| Darktrace | 14.8% |
| Vectra AI | 11.2% |
| Other | 70.6% |
| Type | Title | Date | |
|---|---|---|---|
| Category | Network Detection and Response (NDR) | May 9, 2026 | Download |
| Product | Reviews, tips, and advice from real users | May 9, 2026 | Download |
| Comparison | NetWitness NDR vs Darktrace | May 9, 2026 | Download |
| Comparison | NetWitness NDR vs Vectra AI | May 9, 2026 | Download |
| Comparison | NetWitness NDR vs TrendAI Vision One | May 9, 2026 | Download |
| Title | Rating | Mindshare | Recommending | |
|---|---|---|---|---|
| CrowdStrike Falcon | 4.3 | N/A | 97% | 140 interviewsAdd to research |
| Cortex XDR by Palo Alto Networks | 4.2 | N/A | 96% | 110 interviewsAdd to research |
NetWitness XDR offers a straightforward pricing model without setup costs, ensuring a smooth integration for users. Pricing methods typically involve subscription-based models, accommodating per-user or per-device licensing options. The pricing range is adaptable, catering to organizations of different sizes and complexities, providing comprehensive extended detection and response solutions.
| Company Size | Count |
|---|---|
| Small Business | 7 |
| Midsize Enterprise | 2 |
| Large Enterprise | 3 |
| Company Size | Count |
|---|---|
| Small Business | 92 |
| Midsize Enterprise | 69 |
| Large Enterprise | 111 |
NetWitness NDR stands out for its comprehensive traffic details and compatibility across operating systems. It features a unified dashboard and lightweight installation, making it user-friendly without IT support. The system supports orchestration features and user behavior analytics. While deployment is somewhat modular and complex, it serves well for network security, malware analysis, and digital forensics. NetWitness integrates smoothly with third-party apps using its intuitive API, though improvements could be made in areas like SOAR integration, hunting features, and scalability, alongside addressing pricing and licensing complexities.
What are NetWitness NDR's Key Features?Banks and telecom companies utilize NetWitness NDR for detecting indicators of compromise, analyzing intrusion history, and providing risk scores. It functions as both a SIEM tool and a network forensic instrument, proving essential for sectors focused on network security and threat prevention.
NetWitness NDR was previously known as RSA ECAT, NetWitness Network.
ADP, Ameritas, Partners Healthcare
| Author info | Rating | Review Summary |
|---|---|---|
| Manager, IT Security Operations at a non-profit with 11-50 employees | 3.0 | We use this stable NDR solution, finding it easy to use with good support. However, threat detection needs improvement with more intelligence, as it's not very scalable and is expensive. |
| Senior Cyber Security Analyst (SAFe Agile) at a transportation company with 1,001-5,000 employees | 3.5 | I use NetWitness Endpoint for anomaly detection and forensics, appreciating its interoperability and easy pivoting. However, its blocking feature is ineffective, requiring improvements like proper process and IP blocking, which it currently lacks. |
| Associate Vice President - IT Security at Inspira Enterprise | 4.5 | I rate RSA NetWitness Network 9/10, praising its stable unified dashboard and good support, delivering ROI. Improvements are needed for non-native integration and scalability. I advise due diligence for cost-effective deployment. |
| Senior Cybersecurity Consultant at CIA Botswana | 5.0 | I find RSA NetWitness Endpoint excellent for instant threat detection, malware analysis, and endpoint visibility. It's stable, scalable, and easy to use with great built-in features. Installation was simple, support is good, and I rate it 10/10. |
| Information Security Engineer at Nhq Distribution Ltd | 4.0 | I use RSA NetWitness Endpoint for IT security and log management. I value its user behavior analytics, but wish for better integration and an improved dashboard. It's a stable, scalable solution that I recommend. |
| Information Security Specialist at Masria Digital payments | 4.5 | I find this stable network security solution has a flexible, easy interface and straightforward setup. However, I'd like improved hunting and investigation features for better visibility. I rate it 9/10. |
| Security Information & Incident Analyst at a financial services firm with 1,001-5,000 employees | 4.0 | I rate this stable, scalable solution an 8/10 for its machine isolation and good ROI, despite customer support being slow. My main concerns are the missing reporting engine and the UI timing out too quickly. |
| Cyber Security Consultant at Mideast Data Systems | 4.0 | I've used RSA NetWitness Endpoint for seven years and find its stability very good. While I recommend it as an evolved XDR solution, I believe its threat intelligence needs improvement and hard-coded IPs hinder migration. |
