"One of the most valuable features of the platform is its ability to provide you with aggregated risk scores based on impact and certainty of threats being detected. This is both applied to individual and host detections. This is important because it enables us to use this platform to prioritize the most likely imminent threats. So, it reduces alert fatigue follow ups for security operation center analysts. It also provides us with an ability to prioritize limited resources."
"The solution provide visibility into behaviors across the full lifecycle of an attack in our network, beyond just the Internet gateway. It makes our security operations much more effective because we are now looking not just at traffic on the border, but we're looking at east-west internal traffic. Now, not only will we see if an exploit kit is being downloaded, but we would be able to see then if that exploit kit was then laterally distributed into our environment."
"It gives you access, with Recall, to instant visibility into your network through something like a SIEM solution. For us, being able to correlate all of this network data without having to manage it, has provided immediate value. It gives us the ability to really work on the stuff where I and my team have expertise, instead of having to manage a SIEM solution..."
"It has reduced the time it takes to respond to attacks. That comes back to the proactive point. It makes us able to lower down in the kill chain, we can react now, rather than reacting to incidents that happened, we can see an instant, in some cases, as it's being implemented, or as it's being launched."
"It keeps up with the network traffic, which is a good thing. It provides more context to plain alerts compared to using an older system. So, it helps an analyst reduce the information overload."
"The dashboard gives me a scoring system that allows me to prioritize things that I should look at. I may not necessarily care so much about one event, whereas if I have a single botnet detection or a brute force attack, I really want to get on top of those."
"One of the core features is that Vectra AI triages threats and correlates them with compromised host devices. From a visibility perspective, we can better track the threat across the network. Instead of us potentially finding one device that has been impacted without Vectra AI, it will give us the visibility of everywhere that threat went. Therefore, visibility has increased for us."
"It has helped us to organize our security. We get a better overview on what is happening on the network, which has helped us get quicker responses to users. If we see malicious activity, then we can quickly take action on it. Previously, we weren't getting an overview as fast as we are now, so we can now provide a quicker response."
"It has definitely helped us improve our mean time to resolution on network issues."
"Great network monitoring, looking at anomaly detection and evaluation."
"It's easy to set up. The deployment takes one or two days. You need to collect the data from a device and then direct it to the portal."
"From what I understand, you can encrypt and unencrypt traffic moving in transit. This is one of the features that we liked about it."
"We find that Stealthwatch can detect the unseen."
"Overall, the implementation is very good."
"The most valuable feature is the log, which can be analyzed by our SIEM solution."
"Visibility is a valuable feature, the ability to see even if the traffic is not going into the firewall"
"In comparison with a lot of systems I used in the past, the false positives are really a burden because they are taking a lot of time at this moment."
"It does a little bit of packet capture on alert so you can look at the packet capture activity going on, but it doesn't collect a whole lot of data. Sometimes it's only one or two frames, sometimes it does collect more. That's why they have the addition of their Recall platform, because that really does help expand the capability."
"I would like to see a bit more strategic metrics instead of technical data. Information that I could show to my executive management team or board would be valuable."
"If you hit a certain number of rules, triage filters, or groups, the UX responds more slowly. However, we have a complex network and a lot of rules. So, our setup might not be a typical implementation example. We even had UX engineers onsite, and they looked at issues, improvements, and user feedback. Since then, it has gotten a lot better, they even built in features that we specifically requested for our company."
"Some of the customization could be improved. Everything is provided for you as an easy solution to use, but working with it and doing specific development could be worked on a bit more in the scope of an incident response team."
"The false positives and the tuning side of it is something that could use improvement. But that could be from our side."
"I would like more integrations with IOCs and threats currently on the Internet. I would also like to know which threats are based on zero-day attacks, current botnets, etc. Therefore, I would like more information on external threats."
"They use a proprietary logging format that is probably 90% similar to Bro Logs. Their biggest area of improvement is finishing out the remaining 10%. That 10% might not be beneficial to their ML engine, but that's fine. The industry standard is Zeek Logs or Bro Logs, or Bro or Zeek, depending on how old you are. While they have 90% of those fields, they're still missing some fields. In very rare instances, some community rules do not have the fields that they need, and we had to modify community rules for our logs. So, their biggest area of improvement would be to just finish their matching of the Zeek standard."
"Many of these tools require extensive on-premises hardware to run."
"Cisco could improve the administration for the customers."
"We would like the solution to make more advances in the way that Extreme Networks has been doing."
"It's a good solid solution but integration with Network Access Control products with Cisco ISE would be good."
"We determined that Stealthwatch wouldn't provide the machine learning model that we required."
"The visualization could be improved, the GUI is not the best."
"Could use a topology diagram which would help get an exact visual."
"The training for this product is not very good and needs to be improved."
Earn 20 points
Cisco Stealthwatch is ranked 4th in Network Traffic Analysis (NTA) with 6 reviews while LogRhythm NetMon is ranked 41st in Network Monitoring Software with 2 reviews. Cisco Stealthwatch is rated 8.4, while LogRhythm NetMon is rated 7.6. The top reviewer of Cisco Stealthwatch writes "Provides valuable security knowledge and helps us improve network performance". On the other hand, the top reviewer of LogRhythm NetMon writes "Provides very good lateral visibility for easy detection of irregular traffic and attacks". Cisco Stealthwatch is most compared with Darktrace, SolarWinds NetFlow Traffic Analyzer, Palo Alto Networks Threat Prevention, ThousandEyes and Cisco Stealthwatch Cloud, whereas LogRhythm NetMon is most compared with SolarWinds NPM, Meraki Dashboard, Flowmon Solution, SolarWinds NetFlow Traffic Analyzer and LiveAction LiveNX. See our Cisco Stealthwatch vs. LogRhythm NetMon report.
We monitor all Network Traffic Analysis (NTA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
