No more typing reviews! Try our Samantha, our new voice AI agent.

Check Point SandBlast Network vs NetWitness Platform comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Check Point SandBlast Network
Average Rating
8.4
Reviews Sentiment
7.2
Number of Reviews
41
Ranking in other categories
Advanced Threat Protection (ATP) (7th)
NetWitness Platform
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Log Management (36th), Security Information and Event Management (SIEM) (34th)
 

Mindshare comparison

Check Point SandBlast Network and NetWitness Platform aren’t in the same category and serve different purposes. Check Point SandBlast Network is designed for Advanced Threat Protection (ATP) and holds a mindshare of 3.3%, up 3.1% compared to last year.
NetWitness Platform, on the other hand, focuses on Log Management, holds 1.2% mindshare, up 0.4% since last year.
Advanced Threat Protection (ATP) Mindshare Distribution
ProductMindshare (%)
Check Point SandBlast Network3.3%
Palo Alto Networks WildFire6.6%
Microsoft Defender for Office 3655.8%
Other84.3%
Advanced Threat Protection (ATP)
Log Management Mindshare Distribution
ProductMindshare (%)
NetWitness Platform1.2%
Splunk Enterprise Security7.3%
IBM Security QRadar4.6%
Other86.9%
Log Management
 

Featured Reviews

Karan Pichlangia - PeerSpot reviewer
Assistant General Manager at Sunteck Realty Pvt Ltd
Advanced threat analysis has reduced malware incidents and gives our security team more confidence
The best features that Check Point SandBlast Network offers include threat emulation for zero-day attacks, which I truly appreciate, and deep file analysis across multiple OS environments. The deep file analysis from Check Point SandBlast Network makes my daily workflow much easier, as I am able to analyze everything in terms of a report about my network. Check Point SandBlast Network has positively impacted my organization, as I have seen huge changes with a notable drop in malware incidents, especially with suspicious attachments; it gives the security team confidence that known or zero-day files are checked automatically. Regarding the huge drop in malware incidents, I estimate that it may be around 20%.
reviewer1130436 - PeerSpot reviewer
Information Technology Security and Infrastructure Expert at a government with 201-500 employees
Helps to deal with potential attacks and is available at a reasonable price
My company has had many benefits from the use of the product in the last eight years. The tool has streamlined our company's incident response process since it serves as a log repository, which allows us to correlate events and access different technology stacks. In our company, we were able to actually find some potential attacks, so it has been very helpful. The tool's integration capability isn't so great. In my company, we managed to integrate it with our Microsoft Azure Subscription, after which we managed to integrate it with other tools. You will face a lot of difficulties if you want to integrate it with your database monitoring tool, PAM solutions, or IAM products. The product has done well overall for my company's teams to deal with their workflow efficiency. I would not recommend the product to others. I rate the tool a seven out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Threat extraction can help us to remove malicious content from documents by converting them to PDF."
"The solution can detect and prevent attacks that may be encrypted."
"It has caught some harmful attachments and downloads."
"Check Point has enabled us to detect a lot of threats and prevented a lot of threats from entering our environments. It has kept us safe."
"When our workers are downloading software, SandBlast Cloud is useful to emulate the downloads that the workers are doing. Then, there are no threats coming into the company."
"It looks out for new cyber ​​threats and generates predictions based on behaviors that are already detected on a daily basis."
"The most efficient and protective characteristics of Check Point's SandBlast solution are that we can see a lot of this protection at the network and mail levels."
"Securing the environment through the sandboxing feature of Check Point SandBlast Network helps my team catch threats before they reach users, and it gives us more confidence in opening files from outside sources, improving our daily workflow."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
"The most valuable feature is the correlation, as it can report in real-time and monitor the management."
"The detection of ransomware in the internal network has benefited my organization."
"Overall, it is easy to implement."
"The most valuable feature is the ability to write rules and triggers for network communication and then being able to investigate based on that, where you can see the payload and deconstruct the packets."
"NetWitness Platform is valuable for creating rules that the solution must detect."
"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."
"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"
 

Cons

"We have noticed a slight performance hit when the Threat Emulation and Extraction features were enabled, but the protection trade-off is worth it for us."
"I chose eight out of ten because I feel it is a good application; however, it is not a ten due to cons such as being not ideal for small IT firms with very small budgets, and it needs to be more transparent and user-friendly when getting into and using it."
"Many Important controls are only available in CLI & very very complicated. All tecli command features should available on GUI so that it will become easy for normal users to monitor & control queue."
"There should be some improvement in the solution's stability and scalability."
"Improvements for Check Point SandBlast Network can be seen in dashboard usability; the threat emulation logs and analysis reports could be made more intuitive and visually appealing."
"There have been a couple of things that we've tried where we read through the documentation, and we were really looking for some help in implementing, and technical support wanted me to try it first, then call them if it breaks. It would be nicer if they would hold my hand a bit more. It makes me nervous in production, as I don't have a lab."
"It has some performance overhead, as sandboxing takes time and real-time delivery depends on threat extraction, requiring high performance."
"The cost is a little bit high-end, and you need to get precise performance metrics in order to get the correct size. Improvements are required in both areas of the tool."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"We encountered stability issues in the earlier versions, and much fewer in the newer versions."
"But the 11.3 version is a complete disaster. You cannot analyze anything."
"We have encountered issues with unresolved crashes."
"Sometimes, it gives me static when integrating Windows-based systems. It should produce a precise log of sorts as to where the problem is. For example, a few days ago because of the McAfee application firewall, I couldn't get access to the particular Windows machine. So, my team and I had to figure out by ourselves that there was a virus responsible for the obstacle. This solution should trigger a meaningful log or message indicating the reason the user or implementer can't get into the machine."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
"The initial setup was complex because it takes a lot of time to complete the implementation."
"The implementation needs assistance."
 

Pricing and Cost Advice

"I think the overall cost for introducing Check Point with SandBlast was reasonable and competitive in the market."
"The cost of Check Point SandBlast Network is annually, and there is only a standard license."
"Choosing the correct set of licenses is essential because, without the additional software blade licenses, the Check Point gateways are just a stateful firewall."
"The pricing is quite effective, not excessively high. On a scale of one to ten, where ten is the highest price, I rate the pricing a nine."
"We would like to try the Threat Extraction blade, but you need to buy a license. Check Point is expensive. I would like to buy things, but I would need the funding."
"We have seen ROI."
"The cost is not significantly high and it can be negotiated during any purchase of NGFW."
"The product's cost is high."
"Compared to the competition, the is price is not that high."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
"The product price was reasonable for my region and the market."
"It’s cheaper to run virtual machines in a VMware environment."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"We are on an annual license for the use of the solution."
"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."
report
Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Outsourcing Company
13%
Construction Company
11%
Manufacturing Company
9%
Financial Services Firm
9%
Construction Company
12%
Financial Services Firm
11%
Comms Service Provider
11%
Outsourcing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business31
Midsize Enterprise8
Large Enterprise13
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What is your experience regarding pricing and costs for Check Point SandBlast Network?
My experience with pricing and setup cost is that pricing was a bit high, but the setup cost was initially justified.
What needs improvement with Check Point SandBlast Network?
I feel that Check Point SandBlast Network could be improved with slight delays in cleaning the file delivery. Additionally, I think it requires proper tuning to avoid unnecessary notifications.
What is your primary use case for Check Point SandBlast Network?
My main use case for Check Point SandBlast Network is advanced threat protection, especially for scanning emails, attachments, web downloads, and incoming files through a sandbox environment. A qui...
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

No data available
RSA Security Analytics
 

Overview

 

Sample Customers

Edenred, State Transport Leasing Company (STLC), Edel AG, Laurenty, Conseil Départemental du Val de Marne, Koch Media
Los Angeles World Airports, Reply
Find out what your peers are saying about Palo Alto Networks, Trellix, Microsoft and others in Advanced Threat Protection (ATP). Updated: October 2026.
920,929 professionals have used our research since 2012.