Try our new research platform with insights from 80,000+ expert users

ArcSight Logger vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

ArcSight Logger
Ranking in Log Management
24th
Average Rating
7.8
Reviews Sentiment
5.8
Number of Reviews
32
Ranking in other categories
No ranking in other categories
NetWitness Platform
Ranking in Log Management
37th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
37
Ranking in other categories
Security Information and Event Management (SIEM) (29th)
 

Mindshare comparison

As of July 2025, in the Log Management category, the mindshare of ArcSight Logger is 0.7%, down from 1.1% compared to the previous year. The mindshare of NetWitness Platform is 0.3%, down from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management
 

Featured Reviews

Nagendra Nekkala. - PeerSpot reviewer
A scalable and stable solution that enables users to see all the event logs in one place
The technical support team is very slow. The support persons do not take prompt action. They take too much time to implement new changes. Even if we tell them that we are not able to get critical logs, they take almost three to four days to provide a resolution. The support is not good.
MOTASHIM Al Razi - PeerSpot reviewer
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It's an efficient solution."
"We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist."
"The ESM use cases are the most valuable. It enables us to use the big data collection inside our company. We are able to create use cases for whatever it suits and I find that the most interesting part of any SIEM solution."
"ArcSight Logger is very stable and useful for customers."
"Some of the most valuable features I really appreciate are the performance, how quick the solution is, and how easy it is to create a query."
"In terms of ArcSight Logger's most valuable feature, it is their scalability. ArcSight's real advantage is its scalability because they have two layers, including the logger layer."
"In our country we are a little bit private in terms of solutions, so we are just starting to use the basic data capture. Now some users can start to use additional features that come with Micro Focus ArcSight like user behavior analytics for investigating."
"The machine learning is a good feature."
"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."
"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"
"The packet capture aspect of it is a valuable feature because it is quite different from a traditional SIEM solution that only carries out investigations based on captured logs."
"The newer 11.5 version that my team is using has found it to have good mapping."
"The product's initial setup phase was not at all difficult."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
"Their technical support responds quickly and are knowledgable."
"The solution is really scalable for the high-end power, enterprise customer."
 

Cons

"In the next release, I want to see more intelligence."
"ArcSight Logger doesn't have features for user or customer behavior analysis."
"We have had problems with archiving."
"The next release should have AI capabilities."
"You have limited reporting capabilities and I wouldn't choose ArcSight Logger for this purpose."
"The platform is quite expensive. They should reduce its cost."
"ArcSight has been sold two or three times, and the quality has decreased."
"Using the ArcSight Logger dashboard is not particularly intuitive or efficient, so it is important to be trained in its use."
"It is not so easy to customize this product."
"We have encountered issues with unresolved crashes."
"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."
"The implementation needs assistance."
"The tool's integration capability isn't so great."
"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."
 

Pricing and Cost Advice

"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."
"ArcSight Logger is very expensive compared to their competitors, but when we talk to the customer and explain what the features are and how we can scale, they understand. Still, ArcSight is more expensive than the competition."
"We have a lifetime license, so we don't pay a monthly fee."
"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."
"The pricing is quite harsh."
"It's not cheap at all as it's a big product and has been in the market for quite some time now."
"I would rate the product a seven out of ten since it's an enterprise product."
"ArcSight is an expensive solution."
"The product is expensive."
"Our license is for one year."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"We are on an annual license for the use of the solution."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"The tool is very expensive, so I rate the pricing a ten out of ten. The solution has an annual subscription."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
860,592 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
18%
Computer Software Company
17%
Government
7%
Educational Organization
6%
Financial Services Firm
17%
Computer Software Company
17%
Manufacturing Company
6%
Government
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about ArcSight Logger?
We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist.
What is your experience regarding pricing and costs for ArcSight Logger?
The pricing isn't the problem. We have a lifetime license, so we don't pay a monthly fee.
What needs improvement with ArcSight Logger?
The solution has room for improvement. We're currently upgrading to the newer version, where they have something like Kafka, a hub for all solutions feeding information into Logger. However, I thin...
What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
 

Also Known As

Micro Focus Arcsight Logger, HPE Arcsight Logger
RSA Security Analytics
 

Overview

 

Sample Customers

China Merchants Bank, Bank AlJazira, Banca Intesa
Los Angeles World Airports, Reply
Find out what your peers are saying about ArcSight Logger vs. NetWitness Platform and other solutions. Updated: June 2025.
860,592 professionals have used our research since 2012.