ArcSight Logger vs NetWitness Platform comparison

OpenText and NetWitness are both solutions in the Log Management category. OpenText is ranked #31 with an average rating of 6.7, while NetWitness is ranked #22 with an average rating of 7.6. OpenText holds a 0.8% mindshare in Log Management, compared to NetWitness’s 0.3% mindshare. Additionally, 80% of OpenText users are willing to recommend the solution, compared to 75% of NetWitness users who would recommend it.

ArcSight Logger

Read 31 ArcSight Logger reviews

1,469 Views
1,332 Comparison Views

80% willing to recommend

NetWitness Platform

Read 37 NetWitness Platform reviews

768 Views
480 Comparison Views

75% willing to recommend

ArcSight Logger

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 9, 2024

NetWitness Platform and ArcSight Logger compete in security information and event management. While NetWitness Platform is more appealing in pricing and support, ArcSight Logger is preferred for its features despite its higher cost.

Features: NetWitness Platform stands out with analytics-driven threat detection, seamless integration capabilities, and robust security measures. ArcSight Logger impresses with its scalability, extensive log management, and ability to handle large data volumes efficiently.

Room for Improvement: NetWitness Platform users note the need for a streamlined workflow, enhanced real-time alerting, and improved user interface. ArcSight Logger would benefit from better search functionalities, refined reporting capabilities, and a less complex user experience.

Ease of Deployment and Customer Service: NetWitness Platform offers a straightforward deployment process with a responsive support team. In contrast, ArcSight Logger's deployment is more complex, but the customer service team excels in problem-solving expertise once operational.

Pricing and ROI: NetWitness Platform is more cost-effective initially, offering a quicker ROI due to lower setup costs. ArcSight Logger, despite higher upfront expenses, is valued for its long-term benefits and robust security features, leading to a favorable ROI in demanding data environments.

To learn more, read our detailed ArcSight Logger vs. NetWitness Platform Report (Updated: April 2025).

Buyer's Guide

ArcSight Logger vs. NetWitness Platform

April 2025

Download the complete report

Helped 850,028 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

ArcSight Logger

Ranking in Log Management

31st

Average Rating

7.8

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

No ranking in other categories

NetWitness Platform

Ranking in Log Management

22nd

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (22nd)

Mindshare comparison

As of May 2025, in the Log Management category, the mindshare of ArcSight Logger is 0.8%, down from 1.1% compared to the previous year. The mindshare of NetWitness Platform is 0.3%, down from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Geraldo Freitas

Analista de TI - suporte a redes e segurança at Tribunal de Contas da União

Enhances our security incident investigation but not good for correlation

Investigation is good when you know what you want to search for in Logger. The most difficult part is parsing the logs and configuring the parsers. For investigation, it's good. For correlation, it's not good. We use Sentinel, and Sentinel has pre-built use cases that are much easier to configure. So, it enhances our security incident investigation. We have inbound integration, but configuring the parsers is sometimes very difficult. We only have two use cases where we have a correlation set up. We send the information to Check Point to block IP addresses when we see a lot of blocks from the same source. We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist. So, it offers the ease of integration.

Read full review

MdZaman

IT manager at a agriculture with 10,001+ employees

Really scalable for enterprise customers

The solution should have more integration capabilities with different platforms. The API is nearly open and scalable, so the solution can integrate with many platforms. The solution has more than 200 log sources in the scalability to support, but this is its limit. Installation is pretty easy. However, there are a couple of modules involved, so it is not as easy as it could be. We are talking about a distributed module, not a single-module type. This is what makes things a bit complex, instead of easier. I rate it as a seven out of ten on its installation and configuration capabilities.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It is one of the best products available in the market."

"The ESM use cases are the most valuable. It enables us to use the big data collection inside our company. We are able to create use cases for whatever it suits and I find that the most interesting part of any SIEM solution."

"The most valuable feature is the level of detail that you can see about certain events, even when they do not come up in the console."

"The ability to customize the solution in great detail is its most valuable features. We can customize the use cases and also have the ability to do scripting. We can personalize our dashboard as well. The scalability the solution offers is quite impressive."

"I am impressed with the product's ability to pick up logs. It also has UEBA which has reduced the time to take charge of the events."

"We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist."

"ArcSight provides the basic information that we want."

"It's a robust, mature product and you can do some really complex operations and analytics."

More ArcSight Logger pros

"The most valuable feature is the security that it provides."

"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."

"The most valuable features are the integration and ease of use."

"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."

"The packet capture aspect of it is a valuable feature because it is quite different from a traditional SIEM solution that only carries out investigations based on captured logs."

"The most valuable feature is the correlation. It can report in real-time and monitor the management."

"The product has a user-friendly interface and a valuable feature for threat intelligence integration."

"Offers a good wireless feature."

More NetWitness Platform pros

Cons

"The product's connectors should work better and the user manuals need an update."

"It's not a new product and is a bit complex. So, it requires a person dedicated to working on it and to know about it in and out. It is a huge product, and the search operation is a bit complicated for a new user or someone who has not used it for long. So for that person, it becomes a bit difficult."

"We have had problems with archiving."

"I would rate the technical support only 5 out of 10. The technical support is not satisfactory."

"The speed of Logger indexing and searching for certain bugs for some queries that we provide could be improved. It can handle a huge number of logs but it can be improved."

"In the next release, I want to see more intelligence."

"You have limited reporting capabilities and I wouldn't choose ArcSight Logger for this purpose."

"I had some latency issues for two months. I had to increase our storage capacity significantly to reduce the latency."

More ArcSight Logger cons

"RSA NetWitness Logs and Packets can improve the threat level aspect, it is lacking compared to other solutions. Whenever any hacking activity or any other threat factor occurred they used to provide the coverages very fast when comparing RSA NetWitness Logs and Packets. I heard the other three solutions, from a discussion with my team members who had experience in other solutions, they used to say that. Whenever any issues happened across the globe RSA NetWitness Logs and Packets are a little bit slow improving those detection mechanisms."

"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."

"There is no support for this product in this country, so problems have to be resolved through global technical teams."

"We have encountered issues with unresolved crashes."

"Security needs improvement."

"The implementation needs assistance."

"Technical support could be improved."

"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."

More NetWitness Platform cons

Pricing and Cost Advice

"ArcSight is an expensive solution."

"We have a lifetime license, so we don't pay a monthly fee."

"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."

"I would rate the product a seven out of ten since it's an enterprise product."

"ArcSight Logger is very expensive compared to their competitors, but when we talk to the customer and explain what the features are and how we can scale, they understand. Still, ArcSight is more expensive than the competition."

"It's not cheap at all as it's a big product and has been in the market for quite some time now."

"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."

"The pricing is quite harsh."

"It is cheap."

"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."

"It provides tools to assist in selecting the appropriate license and usage scenarios."

"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."

"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."

"We are on an annual license for the use of the solution."

"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."

"It’s cheaper to run virtual machines in a VMware environment."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

850,028 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

19%

Computer Software Company

17%

Government

Educational Organization

Computer Software Company

19%

Financial Services Firm

18%

Government

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about ArcSight Logger?

We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist.

See all answers

What is your experience regarding pricing and costs for ArcSight Logger?

The pricing isn't the problem. We have a lifetime license, so we don't pay a monthly fee.

See all answers

What needs improvement with ArcSight Logger?

The solution has room for improvement. We're currently upgrading to the newer version, where they have something like Kafka, a hub for all solutions feeding information into Logger. However, I thin...

See all answers

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

See all answers

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

See all answers

Comparisons

Splunk Enterprise Security vs ArcSight Logger

Compared 37% of the time

IBM Security QRadar vs ArcSight Logger

Compared 35% of the time

Elastic Security vs ArcSight Logger

Compared 8% of the time

Wazuh vs ArcSight Logger

Compared 8% of the time

Grafana Loki vs ArcSight Logger

Compared 5% of the time

More ArcSight Logger Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 28% of the time

IBM Security QRadar vs NetWitness Platform

Compared 18% of the time

Elastic Security vs NetWitness Platform

Compared 14% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 11% of the time

RSA enVision vs NetWitness Platform

Compared 10% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

ArcSight Logger

April 2025

Download ArcSight Logger product report

Buyer's Guide

NetWitness Platform

April 2025

Download NetWitness Platform product report

Also Known As

Micro Focus Arcsight Logger, HPE Arcsight Logger

RSA Security Analytics

Overview

HPE ArcSight Data Platform (ADP) offers a future-ready data solution that enriches data in real time and supports open standards for better threat detection. Using security data connectors, ADP collects data and enriches it in real-time to give analysts organized information that can be acted upon instantly.

OpenText

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Sample Customers

China Merchants Bank, Bank AlJazira, Banca Intesa

Los Angeles World Airports, Reply

Buyer's Guide

ArcSight Logger vs. NetWitness Platform

April 2025

Free Report: ArcSight Logger vs. NetWitness Platform

Find out what your peers are saying about ArcSight Logger vs. NetWitness Platform and other solutions. Updated: April 2025.

DOWNLOAD NOW

850,028 professionals have used our research since 2012.

See our ArcSight Logger vs. NetWitness Platform report.

See our list of best Log Management vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.