Cisco Sourcefire SNORT vs ExtraHop Reveal(x) comparison

Intrusion Detection and Prevention Software (IDPS)

Download the complete report

Helped 866,561 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cisco Sourcefire SNORT

Average Rating

7.6

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Intrusion Detection and Prevention Software (IDPS) (16th)

ExtraHop Reveal(x)

Average Rating

8.6

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Network Traffic Analysis (NTA) (3rd), Network Detection and Response (NDR) (4th)

Mindshare comparison

While both are Network Security Systems solutions, they serve different purposes. Cisco Sourcefire SNORT is designed for Intrusion Detection and Prevention Software (IDPS) and holds a mindshare of 3.5%, up 3.3% compared to last year.
ExtraHop Reveal(x), on the other hand, focuses on Network Traffic Analysis (NTA), holds 15.1% mindshare, down 18.0% since last year.

Intrusion Detection and Prevention Software (IDPS) Market Share Distribution
Product	Market Share (%)
Cisco Sourcefire SNORT	3.5%
Darktrace	18.0%
Vectra AI	10.6%
Other	67.9%

Intrusion Detection and Prevention Software (IDPS)

Network Traffic Analysis (NTA) Market Share Distribution
Product	Market Share (%)
ExtraHop Reveal(x)	15.1%
Darktrace	24.4%
Cisco Secure Network Analytics	15.3%
Other	45.2%

Network Traffic Analysis (NTA)

Featured Reviews

Jack Poon

Treasury Specialist at Dah Sing Bank

Offers ease of setup and good documentation

When it comes to the product's deployment phase, we have a lot of vendor support. We have a lot of skills here in Hong Kong. Our company doesn't find any problem deploying Cisco solutions. The solution is deployed on an on-premises version. Speaking about the time required to deploy the solution, I would say that we have quite a lot of previous experience with deploying Cisco products. We have our company's standard design document, which we need to follow. We have a standard testing procedure for all those features. We just take out some appropriate parts and then compile them into one document for an individual project. It is actually quite easy for us to do the documentation, so it just takes one or two hours, and we can do the implementation because all the materials and testing procedures are already in our company standard documents, so it is not that difficult for us.

Read full review

Henri Heuvel

Technical Consultant at Axians

Cloud-based administration streamlines network security management

ExtraHop Reveal(x) can improve regarding integration capabilities. For instance, the market is getting really flooded with Microsoft Sentinel, and I know there is an integration possible, but the tools on the market right now indicate that integration should not be a skill from an integrator point of view. It should be quite easy for customers to integrate that solution into SOCs, SIEMs, or any other integration with other tools. There are various integrations from which there's a manual on how to do it, but specifically, the Microsoft portfolio, particularly Sentinel, integration is not yet there. If you score them on a scale of one to ten, ExtraHop scores around a 7.5 to an 8 on an integration basis, but there's actually room for improvement on that side. In the older days, ExtraHop had a license model where you could do all you can eat, so if you had a sensor with 10 gig of capacity, you could use all the entire 10 gig of throughput. They changed that to an asset-based license model, and that's an absolute downside of the solution, where it is harder for smaller companies to acquire the solution itself. That has given us quite some problems in positioning the solution properly within the network, so the licensing model is an absolute downside where they need to improve.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Cisco technical support is unbeatable. It offers a premium service every time."

"The most valuable feature is the ability to automatically learn the traffic in our environment, and change the merit recommendations based on that."

"The tool's most valuable feature is threat detection, which is important because we have multiple layers not only in Cisco."

"In general, the features are all great. However, if I need to take hardware for ASA, because they need to upgrade to Firepower, we want to create rules. For that, most of the time we go to the command line. Right now Firepower is working really hard on the grid. You can apply all those rules to the grid. Even if you want to monitor the logs, for example, the activity will tell you which particular user has been blocked because of that rule. Firepower's monitoring interface is very good, because you can see each and every piece. ASA also had it, but there you needed to type the command and be under the server to see all that stuff. In Firepower you have the possibility to go directly to the firewall. The way the monitoring is displayed is also very nice. The feature I appreciate most in Firepower is actually the grid. The grid has worked very well."

"Solid intrusion detection and prevention that scales easily in very large environments."

"The most valuable feature of this solution is the filtering."

"The most valuable features of Cisco Sourcefire SNORT are the dashboard for monitoring events."

"The most valuable feature is the visibility that we have across the virtual environment."

More Cisco Sourcefire SNORT pros

"The solution's ability to decrypt SSL traffic is its most valuable feature."

"The security features of this solution are the most valuable."

"We had useful information within the hour of deployment. The ability to trace back for historical analysis, as well as the behavioral analysis done with the security information, puts the user in a position to make an informed decision to mitigate the performance or security incidents. Regarding the security incidents, Reveal (x) is able to create incident cards that guide your teams through the incidents and gives you the option to delve into the transaction detail to potentially view payloads as well."

"When there are performance issues with an HTTP app, ExtraHop enables us to identify the causes within a few minutes. We can see what transactions are being impacted by something that may be happening within the server environment."

"Reveal X integrates seamlessly with CrowdStrike. If you see something sketchy on the network, you can quarantine devices through ExtraHop and it'll push to the CrowdStrike server."

"The most valuable features of ExtraHop Reveal(x) are the detection and alerting of network behavior and anomalies."

"The solution works well for sending sensors."

"The solution's initial setup process is easy."

More ExtraHop Reveal(x) pros

Cons

"The main dashboard of Cisco Sourcefire SNORT could improve."

"If the price is brought down then everybody will be happy."

"While the alerts they offer are good, it could improve it in the sense that they should be more detailed to make the alerts more useful to us in general. Sometimes the solution will offer up false positives. Due to the fact that the alerts aren't detailed, we have to go dig around to see why is it being blocked. The solution would be infinitely better if there was just a bit more detail in the alert information and logging we receive."

"To be frank, the product is not really stable, although they're working on that. Whenever I go to the technical community with an issue, they will usually say that it is not there yet, but the technical team are working on it. The issues are not insolvable. I think they should just keep working on the product to make sure that the product can become very stable. The technical support is great. I appreciate that. We have a lot of communities supporting Firepower now, so you can find help for whatever issue you have."

"There are problems setting up VPNs for some regions."

"The customization of the rules can be simplified."

"The initial setup is a little difficult compared to other products in the market. It depends on the environment. If we are doing any migration, it might take months in a brown-field environment."

"The implementation could be a bit easier."

More Cisco Sourcefire SNORT cons

"I think the tuning capabilities could be improved. We're working on minimizing false positives. Apart from that, everything seems fine to me."

"The solution’s pricing could be improved."

"The solution is expensive and gets more expensive if a company needs to scale it."

"It needs integration with more security vendors."

"The solution should include more support protocols."

"Currently, we have to check manually as we do not receive any notifications about new patches, maintenance, or firmware releases."

"There is a little training online, but it'd be cool if ExtraHop provided certifications. CrowdStrike does elective training that gives you a certification as a Falcon administrator. It'd be nice to see ExtraHop have something like that"

"Agent management could certainly use some focus. It should also be a little bit easier to work with collections. We should be able to nest collections within collections. There should be better nesting."

More ExtraHop Reveal(x) cons

Pricing and Cost Advice

"We have a three-year license for this solution."

"If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five."

"The cost is per port and can be expensive but it does include training and support for three years."

"Licensing for this solution is paid on a yearly basis."

"I don't know the exact amount, but most of the time when I go to a company with a proposition, they will say, "This thing that you are selling is good, but it's expensive. Why don't you propose something like FortiGate, Check Point, or Palo Alto?" Cisco device are expensive compared to other devices."

"The solution is based on an annual subscription model and is expensive."

"I rate ExtraHop Reveal(x) six out of 10 for affordability. We pay for an annual license. It's always one of those trade-offs. You get a lot of value, but ExtraHop isn't exorbitantly priced. You can pay extra for additional features like the ability to decode HL7 traffic, which is crucial for EMR environments."

"I would rate the price a three out of five. It could be less expensive."

"I rate the price of ExtraHop Reveal(x) a seven on a scale of one to ten, where one is a high price, and ten is a low price."

See which vendors are best for you

Use our free recommendation engine to learn which Intrusion Detection and Prevention Software (IDPS) solutions are best for your needs.

See recommendations

866,561 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

13%

University

Financial Services Firm

Government

Financial Services Firm

16%

Computer Software Company

12%

Healthcare Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	8
Large Enterprise	7

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	4
Large Enterprise	9

Questions from the Community

What do you like most about Cisco Sourcefire SNORT?

The product is inexpensive compared to leading brands such as Palo Alto or Fortinet.

What is your experience regarding pricing and costs for Cisco Sourcefire SNORT?

If one is an extremely expensive product, and ten is cheap, I rate the tool's price as a five. There are some other tools in the market that are more expensive than Cisco. There are no additional c...

What needs improvement with Cisco Sourcefire SNORT?

Cisco offers the Cisco DNA Center, which is a source that provides crucial information for us to monitor performance, and see whether there is any trouble. We are using Cisco DNA center, but again,...

What is the best network monitoring software for large enterprises?

We just did an assessment for our 47 datacenters around North America. The top two enterprise-level network monitoring solutions were ExtraHop first, Riverbed SteelCenter second. Their negotiated c...

What open source tool can one use to measure bandwidth from one's upstream service provider?

One I am looking closely at is AppNeta. They have an appliance that can digest the flow and do a better job than Netflow. The other one we are using is ExtraHop. This has both a Datacenter Hig...

What do you like most about ExtraHop Reveal(x)?

With ExtraHop Reveal(x), it gives me more visibility into the packets. It doesn't provide the entire packet capture, but it offers more information on how connections are made at the network layer....

Fortinet FortiGate IPS vs Cisco Sourcefire SNORT

Comparisons

Compared 20% of the time

Cisco Secure IPS (NGIPS) vs Cisco Sourcefire SNORT

Compared 20% of the time

Palo Alto Networks Advanced Threat Prevention vs Cisco Sourcefire SNORT

Compared 18% of the time

Zscaler Cloud IPS vs Cisco Sourcefire SNORT

Compared 10% of the time

Trend Micro TippingPoint Threat Protection System vs Cisco Sourcefire SNORT

Compared 10% of the time

More Cisco Sourcefire SNORT Competitors

Darktrace vs ExtraHop Reveal(x)

Compared 24% of the time

Vectra AI vs ExtraHop Reveal(x)

Compared 24% of the time

Corelight vs ExtraHop Reveal(x)

Compared 11% of the time

Cisco Secure Network Analytics vs ExtraHop Reveal(x)

Compared 7% of the time

ExtraHop Reveal(x) 360 vs ExtraHop Reveal(x)

Compared 4% of the time

More ExtraHop Reveal(x) Competitors

Product Reports

Cisco Sourcefire SNORT

Download Cisco Sourcefire SNORT product report

ExtraHop Reveal(x)

Download ExtraHop Reveal(x) product report

Also Known As

Sourcefire SNORT

Reveal(x), Revealx

Overview

Snort is an open-source, rule-based, intrusion detection and prevention system. It combines the benefits of signature-, protocol-, and anomaly-based inspection methods to deliver flexible protection from malware attacks. Snort gained notoriety for being able to accurately detect threats at high speeds.

Cisco

ExtraHop Reveal(x) is a highly effective network traffic analysis (NTA) solution that leverages a cloud-native architecture to empower organizations to overcome a world filled with increasingly sophisticated threats. It identifies 25% more threats than its competitors. Additionally, organizations that employ Reveal(x) say they resolve issues 77% percent faster than they would if they were using other similar solutions.

ExtraHop Reveal(x) Benefits

Some of the ways that organizations can benefit by choosing to deploy ExtraHop Reveal(x) include:

Total network visibility. Reveal(x) gives users the ability to view every component of their network and devices connected to it in real time. It can automatically recognize and classify the devices that are communicating across an organization’s network. These devices are scanned by powerful decryption software that reveals hidden threats and the details of critical transactions without compromising privacy or compliance rules. Organizations are given full East-West visibility across both physical data centers and cloud environments. Threats that are on the periphery are brought to the attention of the administrators tasked with watching out for them.

Identify threats in real time. Reveal(x) extracts more than 5,000 features from the L2-L7 security layers at any given time, feeds them into its machine learning engine, and presents them to its rule-based detection feature. These features make it possible for the solution to identify the most severe threats. Users can conduct a threat triage and address the threats that their system detects in the order of severity that these threats represent.

Ease of use. Users of Reveal(x) can easily make full use of its event remediation features without expending long periods of time learning them. Its workflows are designed so that administrators can go from a security event to the cause of the event in only a couple of clicks. What would normally take hours can be completed in moments.

ExtraHop Reveal(x) Features

Integration suite. Reveal(x) enables users to utilize a robust suite of integrations. If users feel they are missing important capabilities, they can bolster their security feature toolbox with those offered by third-party solutions. Phantom, Splunk, and Palo Alto are three examples of solutions that Reveal(x) enables users to connect to in order to fill in a gap in their security capabilities.

Automated inventory. Reveal(x) automatically creates a detailed inventory of all of the devices that it discovers and classifies. This keeps an always up-to-date record of all of the devices that are communicating in a given network.
Machine learning. Reveal(x)’s real-time application analytics is driven by a machine learning engine. It detects anomalies in an organization’s network traffic, thus enabling users to keep ahead of any and all threats while reducing the number of false positives that administrators have to sort through.

Reviews from Real Users

ExtraHop Reveal(x) is a solution that stands out when compared to many other similar solutions. Two major advantages that it offers are its versatility and its ability to quickly identify the root cause of an application’s issues.

John B., the senior monitoring engineer at a financial services firm, says, “It's useful for different teams in our organization. The cybersecurity team uses it because it has got great analytics for anomaly detection, malware detection, and ransomware. It's used by the networking people because it's great to be able to get the three-way handshake between systems to see how your network is doing. The microservices for DNS use it because they like to be able to see how their DNS services are operating and how many DNS requests are being rejected, denied, or dropped. Application people love it because it fully decrypts their traffic.

Henry S., a systems engineer at LifePoint Health, writes, "When there are performance issues with an HTTP app, ExtraHop enables us to identify the causes within a few minutes. We can see what transactions are being impacted by something that may be happening within the server environment."

ExtraHop Networks

Sample Customers

CareCore, City of Biel, Dimension Data, LightEdge, Lone Star College System, National Rugby League, Port Aventura, Smart City Networks, Telecom Italia, The Department of Education in Western Australia

Wood County Hospital

Intrusion Detection and Prevention Software (IDPS)