ArcSight Logger vs NetWitness Platform comparison

OpenText and NetWitness are both solutions in the Log Management category. OpenText is ranked #45 with an average rating of 6.8, while NetWitness is ranked #34 with an average rating of 8.3. OpenText holds a 0.9% mindshare in Log Management, compared to NetWitness’s 0.6% mindshare. Additionally, 81% of OpenText users are willing to recommend the solution, compared to 75% of NetWitness users who would recommend it.

ArcSight Logger

Read 32 ArcSight Logger reviews

1,430 Views
1,430 Comparison Views

81% willing to recommend

NetWitness Platform

Read 36 NetWitness Platform reviews

1,929 Views
945 Comparison Views

75% willing to recommend

ArcSight Logger

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 9, 2024

NetWitness Platform and ArcSight Logger compete in security information and event management. While NetWitness Platform is more appealing in pricing and support, ArcSight Logger is preferred for its features despite its higher cost.

Features: NetWitness Platform stands out with analytics-driven threat detection, seamless integration capabilities, and robust security measures. ArcSight Logger impresses with its scalability, extensive log management, and ability to handle large data volumes efficiently.

Room for Improvement: NetWitness Platform users note the need for a streamlined workflow, enhanced real-time alerting, and improved user interface. ArcSight Logger would benefit from better search functionalities, refined reporting capabilities, and a less complex user experience.

Ease of Deployment and Customer Service: NetWitness Platform offers a straightforward deployment process with a responsive support team. In contrast, ArcSight Logger's deployment is more complex, but the customer service team excels in problem-solving expertise once operational.

Pricing and ROI: NetWitness Platform is more cost-effective initially, offering a quicker ROI due to lower setup costs. ArcSight Logger, despite higher upfront expenses, is valued for its long-term benefits and robust security features, leading to a favorable ROI in demanding data environments.

To learn more, read our detailed ArcSight Logger vs. NetWitness Platform Report (Updated: December 2025).

Buyer's Guide

ArcSight Logger vs. NetWitness Platform

December 2025

Download the complete report

Helped 881,114 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

ArcSight Logger

Ranking in Log Management

45th

Average Rating

7.6

Reviews Sentiment

5.8

Number of Reviews

Ranking in other categories

No ranking in other categories

NetWitness Platform

Ranking in Log Management

34th

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (31st)

Mindshare comparison

As of January 2026, in the Log Management category, the mindshare of ArcSight Logger is 0.9%, up from 0.8% compared to the previous year. The mindshare of NetWitness Platform is 0.6%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management Market Share Distribution
Product	Market Share (%)
NetWitness Platform	0.6%
ArcSight Logger	0.9%
Other	98.5%

Log Management

Featured Reviews

Mohammed Shoaib Abdulla

Sr. Cybersecurity Consultant IT/OT at EJADA

Compliance and cost-effectiveness have improved while critical infrastructure security adapts to evolving needs

ArcSight Logger fulfills compliance requirements and passes audit requirements. It is one of the Aramco standards requirements and is recommended by Aramco for any implementation. Aramco, SABIC, water companies, and electricity companies are critical infrastructure with air-gapped networks. In an air-gapped network, there is no communication going out from that network area to the outside world, even to the corporate network. ArcSight Logger is installed on minimal resources with minimal requirements. There are not many upgrades or new features that come up frequently, though they do occur occasionally.

Read full review

MOTASHIM Al Razi

CISO at One Bank Limited

It is a stable solution, but they should make the user interface easier to understand

The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Some of the most valuable features I really appreciate are the performance, how quick the solution is, and how easy it is to create a query."

"ArcSight's robustness is its most valuable feature."

"ArcSight Logger is very stable and useful for customers."

"Our return on investment for implementing ArcSight Logger over the past 12 months has been positive."

"We check a lot of logs in ArcSight Logger because we're running a massive database platform."

"The technical support team is good...It is a scalable solution."

"The most valuable feature is the search capability, which is simple to use."

"It is one of the best products available in the market."

More ArcSight Logger pros

"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."

"The most valuable feature is the hunting ability to work in a CERT."

"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."

"The most valuable feature is the correlation. It can report in real-time and monitor the management."

"The software is scalable to whatever is required, and you can also put a lot of resources in the cloud."

"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."

"In my opinion, the solution's most valuable feature is its capacity to monitor network traffic, logs from devices within the network, and network captures. This capability extends beyond logs to include full network capturing."

"It's quite economical compared to other solutions in the market."

More NetWitness Platform pros

Cons

"We have had problems with archiving."

"The solution should make it possible to integrate network analysis features."

"It's not a new product and is a bit complex. So, it requires a person dedicated to working on it and to know about it in and out. It is a huge product, and the search operation is a bit complicated for a new user or someone who has not used it for long. So for that person, it becomes a bit difficult."

"The product's connectors should work better and the user manuals need an update."

"The next release should have AI capabilities."

"We find that the search and access functionality is quite slow."

"The integration with other systems could be improved."

"You have limited reporting capabilities and I wouldn't choose ArcSight Logger for this purpose."

More ArcSight Logger cons

"The solution should have more integration capabilities with different platforms."

"They should implement algorithms to digest that data and produce additional, more advanced reporting, alerting and support of internal security teams."

"The product's licensing models are complex to understand. This particular area needs improvement."

"The initial setup is complex. There are other solutions that are easier to implement."

"Health monitoring of the event sources and devices."

"Sometimes, it gives me static when integrating Windows-based systems. It should produce a precise log of sorts as to where the problem is. For example, a few days ago because of the McAfee application firewall, I couldn't get access to the particular Windows machine. So, my team and I had to figure out by ourselves that there was a virus responsible for the obstacle. This solution should trigger a meaningful log or message indicating the reason the user or implementer can't get into the machine."

"More customizability is required, which is something that they need to improve on."

"There is no support for this product in this country, so problems have to be resolved through global technical teams."

More NetWitness Platform cons

Pricing and Cost Advice

"I would rate the product a seven out of ten since it's an enterprise product."

"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."

"We have a lifetime license, so we don't pay a monthly fee."

"The pricing is quite harsh."

"It's not cheap at all as it's a big product and has been in the market for quite some time now."

"ArcSight Logger is very expensive compared to their competitors, but when we talk to the customer and explain what the features are and how we can scale, they understand. Still, ArcSight is more expensive than the competition."

"ArcSight is an expensive solution."

"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."

"It provides tools to assist in selecting the appropriate license and usage scenarios."

"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."

"Compared to the competition, the is price is not that high."

"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."

"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."

"This is a pricey solution; it's not cheap."

"We are on an annual license for the use of the solution."

"Our license is for one year."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

881,114 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

13%

Computer Software Company

Manufacturing Company

Healthcare Company

Financial Services Firm

14%

Performing Arts

Computer Software Company

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	10
Large Enterprise	16

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	7
Large Enterprise	20

Questions from the Community

What do you like most about ArcSight Logger?

We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist.

See all answers

What is your experience regarding pricing and costs for ArcSight Logger?

The pricing isn't the problem. We have a lifetime license, so we don't pay a monthly fee.

See all answers

What needs improvement with ArcSight Logger?

This decision is made by higher management as they don't want to have multiple solutions for one solution. ArcSight Logger themselves don't provide good support, but companies such as ours provide ...

See all answers

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

See all answers

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

See all answers

Comparisons

Splunk Enterprise Security vs ArcSight Logger

Compared 25% of the time

IBM Security QRadar vs ArcSight Logger

Compared 23% of the time

Elastic Security vs ArcSight Logger

Compared 11% of the time

LogRhythm SIEM vs ArcSight Logger

Compared 6% of the time

Wazuh vs ArcSight Logger

Compared 6% of the time

More ArcSight Logger Competitors

IBM Security QRadar vs NetWitness Platform

Compared 13% of the time

Splunk Enterprise Security vs NetWitness Platform

Compared 10% of the time

Elastic Security vs NetWitness Platform

Compared 7% of the time

Microsoft Sentinel vs NetWitness Platform

Compared 5% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 5% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

ArcSight Logger

January 2026

Download ArcSight Logger product report

Buyer's Guide

NetWitness Platform

January 2026

Download NetWitness Platform product report

Also Known As

Micro Focus Arcsight Logger, HPE Arcsight Logger

RSA Security Analytics

Overview

HPE ArcSight Data Platform (ADP) offers a future-ready data solution that enriches data in real time and supports open standards for better threat detection. Using security data connectors, ADP collects data and enriches it in real-time to give analysts organized information that can be acted upon instantly.

OpenText

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Sample Customers

China Merchants Bank, Bank AlJazira, Banca Intesa

Los Angeles World Airports, Reply

Buyer's Guide

ArcSight Logger vs. NetWitness Platform

December 2025

Free Report: ArcSight Logger vs. NetWitness Platform

Find out what your peers are saying about ArcSight Logger vs. NetWitness Platform and other solutions. Updated: December 2025.

DOWNLOAD NOW

881,114 professionals have used our research since 2012.

See our ArcSight Logger vs. NetWitness Platform report.

See our list of best Log Management vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.