Cisco Secure Network Analytics vs ExtraHop Reveal(x) comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 18, 2024
 

Categories and Ranking

Cisco Secure Network Analytics
Ranking in Network Traffic Analysis (NTA)
3rd
Ranking in Network Detection and Response (NDR)
6th
Average Rating
8.2
Number of Reviews
58
Ranking in other categories
Network Monitoring Software (25th), Cisco Security Portfolio (3rd)
ExtraHop Reveal(x)
Ranking in Network Traffic Analysis (NTA)
4th
Ranking in Network Detection and Response (NDR)
5th
Average Rating
8.6
Number of Reviews
12
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of July 2024, in the Network Traffic Analysis (NTA) category, the mindshare of Cisco Secure Network Analytics is 15.1%, down from 23.2% compared to the previous year. The mindshare of ExtraHop Reveal(x) is 24.3%, up from 14.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Network Traffic Analysis (NTA)
Unique Categories:
Network Monitoring Software
1.5%
Network Detection and Response (NDR)
9.7%
 

Featured Reviews

Richard Payne - PeerSpot reviewer
Feb 13, 2023
Improved our organization greatly but greater customizability would be beneficial
The customizability of the UI should improve. With Splunk and other SIEM tools, you have the ability to create custom dashboards and manipulate the data in a way that works for you. Cisco gives you some creative ability, but you are very much locked into their train of thought. It would be helpful if they went more down the Splunk and Elastic route. We found flaws in Stealthwatch, but thankfully it has the ability to interconnect with Splunk and other such tools. This enabled us to plug the information over where it falls flat and then start working on other platforms. The solution falls down but tries to make up for it. I would also like to have greater insight into how it works under the hood. I appreciate that that might not be possible due to commercial confidentiality. However, having that greater insight would allow us to covey a level of trust to the people who use it.
Henry-Steinhauer - PeerSpot reviewer
Sep 21, 2022
It enabled us to create dynamic triggers that allow us to inspect packet flow in real-time.
We've been able to leverage the information to show other vendors we use that there are issues with the SaaS solution they provide to our EMR physicians. At the top of every hour, they were doing a data recovery operation in the event of an outage of some sort. That was preventing our physicians from using the application. It only lasted about five minutes, but the physicians had to stop working. Of course, when they called the support desk and finally reached a support person, the vendor insisted it was our problem, not theirs. This data helped to prove it was their problem. They eventually brought in some other consultants from the hardware vendor and corrected the issue.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"From what I understand, you can encrypt and unencrypt traffic moving in transit. This is one of the features that we liked about it."
"Being able to identify specific date closed across the network is invaluable."
"The most valuable features are encrypted threat analysis and the ability to run jobs on entire flows."
"The artifacts available in the tool provide better information for analyzing network traffic. It enables a holistic view of network traffic and general packet analysis. It's easy to identify anomalies without the use of signatures. The way in which we implemented Stealthwatch Cloud has enabled my team to analyze traffic behind proxies."
"Visibility. The ability to look East and West. To see what is passing through your circuits, where it is coming from, and how big it is."
"The most valuable part is that Stealthwatch is part of a portfolio of security devices from Cisco. Cisco literally can touch every single end point, every single ingress and egress point in the network. Nobody else has that."
"The ability to send data flow from other places and have them all in one place is very valuable for us."
"I value the feature which enables me to detect devices talking to suspect IPs."
"The solution's initial setup process is easy."
"ExtraHop Reveal(x) is one of the tools that works out of the box when it comes to threat hunting."
"We had useful information within the hour of deployment. The ability to trace back for historical analysis, as well as the behavioral analysis done with the security information, puts the user in a position to make an informed decision to mitigate the performance or security incidents. Regarding the security incidents, Reveal (x) is able to create incident cards that guide your teams through the incidents and gives you the option to delve into the transaction detail to potentially view payloads as well."
"The solution's ability to decrypt SSL traffic is its most valuable feature."
"When there are performance issues with an HTTP app, ExtraHop enables us to identify the causes within a few minutes. We can see what transactions are being impacted by something that may be happening within the server environment."
"It's a wire analytics tool. We use it for isolating and determining issues on our network or applications. It does a lot for crediting the network as opposed to discrediting the network. A lot of people come along and say that it's a network issue. It's always considered to be a network issue, but by using ExtraHop, we can quickly tell them that it's not a networking issue. It's something to do with your application or something at the other end. It could be a database issue. This tool gives us the ability to pinpoint with great accuracy the comings and goings on our network."
"The most valuable features of ExtraHop Reveal(x) are the detection and alerting of network behavior and anomalies."
"The security features of this solution are the most valuable."
 

Cons

"The customizability of the UI should improve."
"I would like to see more and cleaner reporting. For example, if I pull up Steven and I want to look and maybe compare him to what you've done in the past week, and compare that to the past six months, the point would be to see what the difference in activity looks like over this time. I don't see that capability in reporting to date. You see that trend but you don't really see a straightforward comparison. That right there is key to what we want to see about the normal activity."
"We've run into some issues with the configuration."
"It's a good solid solution but integration with Network Access Control products with Cisco ISE would be good."
"The usability of this solution needs to be improved."
"If they can make this product more web-based, that would be amazing."
"One thing I would like to see improved is if it could automatically be tied through ISE, instead of you having to manually get notifications and disable it yourself."
"I would like to see a hybrid solution that can work without being connected directly to the internet for those destinations."
"I would like to see more cloud capability."
"It needs integration with more security vendors."
"Netflow - Processing Netflow can be cumbersome as it requires triggers to truly gain value and insight. This in turn can add a bit of load to the hardware. The focus of ExtraHop Reveal (x) is live packet data."
"The solution’s pricing could be improved."
"The solution should include more support protocols."
"Agent management could certainly use some focus. It should also be a little bit easier to work with collections. We should be able to nest collections within collections. There should be better nesting."
"They used to have the ability to decode Citrix sign-on, setup, and tear down. Unfortunately, Citrix has stopped sharing that knowledge. Citrix has continued to change its model of processing, making it harder and harder to troubleshoot."
"ExtraHop Reveal(x) could improve by allowing a longer look back in the feature. Right now you have a limit of 30 days to look back on your activity. I've used Darktrace before, and they allow you the ability to play back events. This would be a good feature to have in ExtraHop Reveal(x)."
 

Pricing and Cost Advice

"Licensing is on a yearly basis."
"There are additional licenses needed for the number of so-called network flows. It's hard to plan the number of flows you need in the network, this is a problem. The price of the Cisco Stealthwatch is relatively inexpensive"
"It is worth the cost."
"This is an expensive product. We have quit paying for support because we don't want to have to upgrade it and keep paying for it."
"On a yearly basis, licensing is somewhere around $30,000."
"The solution is expensive. It costs several hundred thousand dollars per year (depending on how many flows you are collecting)."
"Pricing is much higher compared to other solutions."
"The yearly licensing cost is about $50,000."
"The solution is based on an annual subscription model and is expensive."
"I would rate the price a three out of five. It could be less expensive."
"I rate ExtraHop Reveal(x) six out of 10 for affordability. We pay for an annual license. It's always one of those trade-offs. You get a lot of value, but ExtraHop isn't exorbitantly priced. You can pay extra for additional features like the ability to decode HL7 traffic, which is crucial for EMR environments."
"I rate the price of ExtraHop Reveal(x) a seven on a scale of one to ten, where one is a high price, and ten is a low price."
report
Use our free recommendation engine to learn which Network Traffic Analysis (NTA) solutions are best for your needs.
793,295 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
30%
Financial Services Firm
11%
Government
8%
Manufacturing Company
6%
Financial Services Firm
16%
Computer Software Company
16%
Manufacturing Company
7%
Healthcare Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Cisco Stealthwatch?
The most valuable feature of Cisco Secure Network Analytics is the Threat Intelligence integration.
What is your experience regarding pricing and costs for Cisco Stealthwatch?
I would rate Cisco SNA as a nine out of ten in terms of costliness.
What needs improvement with Cisco Stealthwatch?
One area that could be improved in SNA is the integration with Cisco ISE for user and session details, which currently requires additional setup.
What is the best network monitoring software for large enterprises?
We just did an assessment for our 47 datacenters around North America. The top two enterprise-level network monitoring solutions were ExtraHop first, Riverbed SteelCenter second. Their negotiated c...
What open source tool can one use to measure bandwidth from one's upstream service provider?
One I am looking closely at is AppNeta. They have an appliance that can digest the flow and do a better job than Netflow. The other one we are using is ExtraHop. This has both a Datacenter Hig...
What do you like most about ExtraHop Reveal(x)?
With ExtraHop Reveal(x), it gives me more visibility into the packets. It doesn't provide the entire packet capture, but it offers more information on how connections are made at the network layer....
 

Also Known As

Cisco Stealthwatch, Cisco Stealthwatch Enterprise, Lancope StealthWatch
Reveal(x), Revealx
 

Learn More

Video not available
 

Overview

 

Sample Customers

Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREF
Wood County Hospital
Find out what your peers are saying about Cisco Secure Network Analytics vs. ExtraHop Reveal(x) and other solutions. Updated: June 2024.
793,295 professionals have used our research since 2012.