Try our new research platform with insights from 80,000+ expert users

Cisco Secure Network Analytics vs Cisco Sourcefire SNORT comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cisco Secure Network Analytics
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
61
Ranking in other categories
Network Monitoring Software (37th), Network Traffic Analysis (NTA) (4th), Network Detection and Response (NDR) (9th), Cisco Security Portfolio (9th)
Cisco Sourcefire SNORT
Average Rating
7.8
Reviews Sentiment
6.8
Number of Reviews
20
Ranking in other categories
Intrusion Detection and Prevention Software (IDPS) (14th)
 

Mindshare comparison

While both are Network Security Systems solutions, they serve different purposes. Cisco Secure Network Analytics is designed for Network Monitoring Software and holds a mindshare of 1.0%, down 1.3% compared to last year.
Cisco Sourcefire SNORT, on the other hand, focuses on Intrusion Detection and Prevention Software (IDPS), holds 3.1% mindshare, up 2.1% since last year.
Network Monitoring Software Market Share Distribution
ProductMarket Share (%)
Cisco Secure Network Analytics1.0%
Zabbix6.9%
SolarWinds NPM3.4%
Other88.7%
Network Monitoring Software
Intrusion Detection and Prevention Software (IDPS) Market Share Distribution
ProductMarket Share (%)
Cisco Sourcefire SNORT3.1%
Fortinet FortiGate13.9%
Darktrace12.2%
Other70.8%
Intrusion Detection and Prevention Software (IDPS)
 

Featured Reviews

Muhammad Harun-Owr-Roshid - PeerSpot reviewer
CEO at BRIGHT-i SYSTEMS LIMITED
Have streamlined network visibility and troubleshooting while seeing benefits from AI integration
In terms of improvements for Cisco Secure Network Analytics, from the implementation point of view, now that AI is in use, some other features need to be upgraded considering AI solutions. Proper management of the database is also important; it should be centralized for easier data collection from a single database. When precise manual analysis is needed, it's sometimes difficult, so having a centralized database will allow network admins to find actual scenarios more effectively, especially since some information may not be visible on the GUI. Cisco should upgrade their hardware part to run the database, because sometimes it cannot handle the load while all features are running in the network. The database management should indeed be centralized because while AI runs behind the systems, central management is essential. For example, in a network with 100 Cisco switches, a few routers, firewalls, and access points, all data generated should be preserved in a central database. This approach simplifies management and analysis for troubleshooting, as GUI interfaces may not always provide visible information. Centralizing the database will allow for better understanding of which information is preserved for each specific device.
reviewer2772102 - PeerSpot reviewer
Cloud Architect at a consultancy with 1-10 employees
Logging and customizable rules have helped improve threat monitoring and detection
The logging is mainly what I consider one of the best features with Cisco Sourcefire SNORT. Being able to log and store it in a file allows you to push it to a centralized repository. The logging and reporting help improve incident response. You should always be logging threats, any sort of misconfiguration, and anything that could be an issue. It's important to at least log and monitor it. The basic rules provide a good baseline in assessing Cisco Sourcefire SNORT's ability in providing real-time analytics for threat detection, but as a professional, you should look to constantly modify that baseline. They provide extensive customizability so you can define your own rules. The customizability allows it to be adaptable in protecting against diverse network threats to the constant change.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable part is that Stealthwatch is part of a portfolio of security devices from Cisco. Cisco literally can touch every single end point, every single ingress and egress point in the network. Nobody else has that."
"The solution reduces the amount of time it takes to detect and remediate threats."
"The most valuable feature of Cisco Secure Network Analytics is the Threat Intelligence integration."
"The most valuable feature is having visibility into the data segments throughout our network."
"Cisco products are incredibly stable, boasting a 200% stability."
"Stability is the most valuable feature we have seen in this solution."
"The solution has increased our threat detection rate. Cisco Stealthwatch has not reduced our incident response times. It has not reduced the amount of time it takes us to detect immediate threats. It has reduced false positives."
"Using the Cognitive Analytics feature, we have complete visibility that we didn’t have before."
"Solid intrusion detection and prevention that scales easily in very large environments."
"The URL filtering is very good and you can create a group for customized URLs."
"The logging is mainly what I consider one of the best features with Cisco Sourcefire SNORT; being able to log and store it in a file allows you to push it to a centralized repository."
"The most valuable feature is the visibility that we have across the virtual environment."
"The whole solution is very good, and stable."
"The solution is stable."
"It has a huge rate of protection. It's has a low level of positives and a huge rate of threat protection. It's easy to deploy and easy to implement. It has an incredible price rate compared to similar solutions."
"The solution is rather easy to use."
 

Cons

"It's not great as a standalone solution."
"I would like Cisco to make it easier for the administrators to use it."
"We had some trouble with the installation as we migrated from our previous solution."
"One update that I would like to see is an agent-based client. Currently, Stealthwatch is network-based. A local agent could help manage endpoints."
"We determined that Stealthwatch wouldn't provide the machine learning model that we required."
"Cisco could improve the administration for the customers."
"The initial setup was complex."
"I would like to see more expansion in artificial intelligence and machine learning features."
"Cisco Sourcefire SNORT can scale, but if you have too much, you could fill up your log files, which I consider when discussing scalability."
"The pricing needs to be improved. We have lots of low-budget clients around us. Budget constraints are always a deterrent in our market."
"I did not experience any pain points that required improvement. Maybe a couple of false-positives, but that's about it."
"I don't think this solution is a time-based control system, because one cannot filter traffic based on time."
"The main dashboard of Cisco Sourcefire SNORT could improve."
"The solution's approach to managing traffic blocking is confusing and impractical."
"There are problems setting up VPNs for some regions."
"The cloud can be improved."
 

Pricing and Cost Advice

"It has a subscription model. There is yearly support, and there is also three-year support. It depends on what the customers want."
"On a yearly basis, licensing is somewhere around $30,000."
"​Licensing is done by flows per second, not including outside (in traffic)."
"The tool is not cheaply priced."
"One of the things which bugs me about Lancope is the licensing. We understand how licensing works. Our problem is when we bought and purchased most of these Lancope devices, we did so with our sister company. Somewhere within the purchase and distribution, licensing got mixed up. That is all on Cisco, and it is their responsibility. They allotted some of our sister company's equipment to us, and some of our equipment to them. To date, they have never been able to fix it."
"NetFlow is very expensive."
"It is worth the cost."
"Our fees are approximately $3,000 USD."
"I don't know the exact amount, but most of the time when I go to a company with a proposition, they will say, "This thing that you are selling is good, but it's expensive. Why don't you propose something like FortiGate, Check Point, or Palo Alto?" Cisco device are expensive compared to other devices."
"The cost is per port and can be expensive but it does include training and support for three years."
"If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five."
"Licensing for this solution is paid on a yearly basis."
"We have a three-year license for this solution."
report
Use our free recommendation engine to learn which Network Monitoring Software solutions are best for your needs.
881,282 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Government
11%
Manufacturing Company
10%
Financial Services Firm
8%
University
13%
Financial Services Firm
10%
Government
8%
Computer Software Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business11
Midsize Enterprise7
Large Enterprise52
By reviewers
Company SizeCount
Small Business6
Midsize Enterprise8
Large Enterprise7
 

Questions from the Community

What is your experience regarding pricing and costs for Cisco Stealthwatch?
Regarding cost, for the Bangladesh context, Cisco Secure Network Analytics is a little bit high-priced because we are a developing country, making it tough to manage affordable solutions. However, ...
What needs improvement with Cisco Stealthwatch?
In terms of improvements for Cisco Secure Network Analytics, from the implementation point of view, now that AI is in use, some other features need to be upgraded considering AI solutions. Proper m...
What is your primary use case for Cisco Stealthwatch?
Our customers mainly use Cisco Secure Network Analytics to get whole network visibility and easy troubleshooting to find actual problems and also to mitigate loopholes or findings immediately to pr...
What do you like most about Cisco Sourcefire SNORT?
The product is inexpensive compared to leading brands such as Palo Alto or Fortinet.
What is your experience regarding pricing and costs for Cisco Sourcefire SNORT?
If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five. There are some other tools in the market that are more expensive than Cisco. There are no additional c...
What needs improvement with Cisco Sourcefire SNORT?
I have not had much experience with the community-driven rule set while utilizing Cisco Sourcefire SNORT. I don't have experience with recognizing zero-day vulnerabilities, but based on my knowledg...
 

Also Known As

Cisco Stealthwatch, Cisco Stealthwatch Enterprise, Lancope StealthWatch
Sourcefire SNORT
 

Overview

 

Sample Customers

Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREF
CareCore, City of Biel, Dimension Data, LightEdge, Lone Star College System, National Rugby League, Port Aventura, Smart City Networks, Telecom Italia, The Department of Education in Western Australia
Find out what your peers are saying about Cisco Secure Network Analytics vs. Cisco Sourcefire SNORT and other solutions. Updated: January 2020.
881,282 professionals have used our research since 2012.