Cisco Secure Network Analytics vs NetWitness XDR comparison

Cancel
You must select at least 2 products to compare!
Comparison Buyer's Guide
Executive Summary

We performed a comparison between Cisco Secure Network Analytics and NetWitness XDR based on real PeerSpot user reviews.

Find out in this report how the two Network Detection and Response (NDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed Cisco Secure Network Analytics vs. NetWitness XDR Report (Updated: March 2024).
765,386 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"It has been pretty stable since we deployed it, and everything seems to be working fine.""The solution reduces the amount of time it takes to detect and remediate threats.""The most valuable feature is integration.""It has improved our internal knowledge of what's going on with the network, and that's helpful.""The solution has increased our threat detection rate. Cisco Stealthwatch has not reduced our incident response times. It has not reduced the amount of time it takes us to detect immediate threats. It has reduced false positives.""Great network monitoring, looking at anomaly detection and evaluation.""The solution's analytics and thrust detection capabilities are good. We're still adjusting it. It's a little hypersensitive, but it is working right now.""The most valuable feature is anomaly detection, where it finds things that are not allowed internally."

More Cisco Secure Network Analytics Pros →

"It is stable. We have been using it for some time, without any issues.""The stability of the RSA NetWitness Endpoint is very good.""The most valuable feature is the way it captures the traffic, and it contains every detail of the communication.""Ability to isolate the machine when there are malicious files.""The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good.""They have recently updated the features and the most valuable ones are the instant threat response, ease of use, web interface, integration, and easy access. RSA NetWitness Endpoint is very compatible with other solutions and technologies. However, they do not rely on third-party solutions and have most features built-in.""Technical support is knowledgeable.""This solution allows us to locate the malware in real-time."

More NetWitness XDR Pros →

Cons
"We are continuing down the road of ACI and ISE with Cisco, so we would like to see the continuation of Stealthwatch integrating into ISE for exchange of information, and also, more into the ACI environment too.""There's a lot of traffic on our network that we don't see sometimes.""At my company, we might not be using it enough with other applications that we have that can integrate with it.""I would like to see it better organized when I'm looking at it.""The initial setup was straightforward but required a lot of data entry, to begin with building out the server types and network types.""Complexity on integration is not so straightforward and you really need an expert to help build it out.""I would like to see some improvement when it comes to reporting.""Stealthwatch is still maturing in AI. It uses artificial intelligence for predictions, but AI still needs to mature. It is in a phase where you get 95% correct detection. As its AI engine learns more, it will become more accurate. This is applicable to all the devices that are using AI because they support both supervised and unsupervised machine learning. The accuracy in the case of supervised machine learning is dependent on the data you feed into the box. The accuracy in the case of unsupervised machine learning is dependent on the algorithm. The algorithm matures depending on retrospective learning, and this is how it is able to detect zero-day attacks."

More Cisco Secure Network Analytics Cons →

"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious.""The initial setup requires a high level of skill.""When analyzing something, you have to click several times. It requires a lot of effort to find something.""The solution is modular, for example you can buy the RSA ePack, which you buy as a module is not part of the conduit solution. They could include it and have it as an all-in-one solution.""I would like to see Security Orchestration and Response Automation (SOAR) integration.""The solution lacks a reporting engine.""RSA NetWitness Network could improve on integration with non-native application integration.""The contamination feature could be improved."

More NetWitness XDR Cons →

Pricing and Cost Advice
  • "It is worth the cost."
  • "Licensing is done by flows per second, not including outside>in traffic."
  • "Pricing is much higher compared to other solutions."
  • "​Licensing is done by flows per second, not including outside (in traffic)."
  • "Today, we are part of the big Cisco ELA, and it is a la carte. We can get orders for whatever we want. At the end of the day, we have to pay for it in one big expense, but that is fine. We are okay with that."
  • "NetFlow is very expensive."
  • "One of the things which bugs me about Lancope is the licensing. We understand how licensing works. Our problem is when we bought and purchased most of these Lancope devices, we did so with our sister company. Somewhere within the purchase and distribution, licensing got mixed up. That is all on Cisco, and it is their responsibility. They allotted some of our sister company's equipment to us, and some of our equipment to them. To date, they have never been able to fix it."
  • "The licensing costs are outrageous."
  • More Cisco Secure Network Analytics Pricing and Cost Advice →

  • "With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
  • "They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
  • "It is highly scalable. It can be bought based on your requirements."
  • "I do not have any opinion on the pricing or licensing of the product."
  • "The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
  • "It is an expensive product."
  • "The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
  • "The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."
  • More NetWitness XDR Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.
    765,386 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:The most valuable feature of Cisco Secure Network Analytics is the Threat Intelligence integration.
    Top Answer:I would rate Cisco SNA as a nine out of ten in terms of costliness.
    Top Answer:Initially, I felt Cisco Secure Network Analytics lacked integration with Splunk. However, with Cisco's recent acquisition of Splunk, it seems this gap will be addressed. If this integration happens… more »
    Top Answer:Technical support is knowledgeable.
    Top Answer:The solution is expensive. I'd rate it at a one or two out of five. They need to adjust it to keep up with the competition. I cannot speak to the exact pricing of the product.
    Top Answer:I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not… more »
    Ranking
    Views
    4,134
    Comparisons
    3,189
    Reviews
    8
    Average Words per Review
    528
    Rating
    8.4
    Views
    711
    Comparisons
    504
    Reviews
    7
    Average Words per Review
    322
    Rating
    7.9
    Comparisons
    Also Known As
    Cisco Stealthwatch, Cisco Stealthwatch Enterprise, Lancope StealthWatch
    RSA ECAT, NetWitness Network
    Learn More
    Cisco
    Video Not Available
    NetWitness
    Video Not Available
    Overview

    Cisco Secure Network Analytics is a highly effective network traffic analysis (NTA) solution that enables users to find threats in their network traffic even if those threats are encrypted. It turns an organization’s network telemetry into a tool that creates a complete field of vision for the organization’s administrators. Users can find threats that may have infiltrated their systems and stop them before they can do irreparable harm.

    Cisco Secure Network Analytics Benefits

    A few ways that organizations can benefit by choosing to deploy Cisco Secure Network Analytics include:

    • Security scaling. Secure Network Analytics makes it easy for organizations to scale up their level of network protection to match the growth that their business is experiencing. It can be deployed on whatever type of system is necessary. Users will have their growth needs met at every stage of their business journey because the solution offers users the ability to use it on-premises or in the cloud and it can be consumed as a SaaS-based or license-based solution. Whenever any kind of device is added, Secure Network Analytics can automatically classify that device so that it is seamlessly integrated into its network protection system.
    • Detects threats as they appear. Users gain the ability to scan their network traffic for even the most advanced threats at all times. Secure Network Analytics easily identifies the early warning signs that are typically initiated before attacks are conducted by bad actors. Once these signs are found, users are warned so that they can take steps to prevent those threats from escalating. This also enables users to determine the source of the threat and whether it might have spread further than initially thought.
    • Eliminate blind spots. Organizations that use Secure Network Analytics can view their network traffic across both private networks and public cloud environments. The scanning power of the solution allows users to gain complete visibility with a fewer number of sensors than their competitors require to achieve a similar level of protection.

    Cisco Secure Network Analytics Features

    Some of the many features that Cisco Secure Network Analytics offers include:

    • Centralized security management. Secure Network Analytics’ Identity Services Engine feature enables users to control their network from a single graphical user interface. Administrators can simplify their jobs by controlling profiler, posture, guest, authentication, and authorization services from a single pane of glass.
    • Machine learning tools. Secure Network Analytics uses machine learning to generate alerts when malicious or suspicious activity is detected. It also analyzes the threat so that users gain insight into the nature of the dangers that confront them. Additionally, it examines the threats to determine whether they are actual threats or false alarms. This significantly reduces the number of false alarms that administrators have to spend time attempting to resolve.
    • Automation. Users can automate routine tasks that users would otherwise have to handle manually. This automation feature frees administrators and employees to handle other more critical tasks.

    Reviews from Real Users

    Cisco Secure Network Analytics is a solution that stands out even when compared to many other comparable products. Two major advantages that it offers are the way that it enables users to define the threshold at which the solution will issue a warning to administrators and the predefined alerts that it offers straight out of the box.

    Gerald J., the information technology operations supervisor at Aboitiz Equity Ventures, Inc., writes, “StealthWatch lets me see the ports running in and out and the country. It has excellent reporting, telemetry, and artificial intelligence features. With the telemetry, I can set thresholds to detect sudden changes and the alarms go through the PLC parts. I can see all the ports running on that trunk.”

    A senior security engineer at a tech services company, says, “Cisco Stealthwatch has predefined alerts for different types of security issues that might happen in the network. Whether it's PCs or servers that are used for botnets or Bitcoin mining we receive the alerts automatically. This functionality is what we receive from the solution out of the box.”

    Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness XDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.

    Sample Customers
    Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREF
    ADP, Ameritas, Partners Healthcare
    Top Industries
    REVIEWERS
    Healthcare Company23%
    Financial Services Firm16%
    Comms Service Provider9%
    Manufacturing Company7%
    VISITORS READING REVIEWS
    Computer Software Company27%
    Financial Services Firm10%
    Government9%
    Manufacturing Company5%
    VISITORS READING REVIEWS
    Financial Services Firm16%
    Computer Software Company15%
    Government8%
    Manufacturing Company7%
    Company Size
    REVIEWERS
    Small Business15%
    Midsize Enterprise9%
    Large Enterprise76%
    VISITORS READING REVIEWS
    Small Business16%
    Midsize Enterprise10%
    Large Enterprise73%
    REVIEWERS
    Small Business59%
    Midsize Enterprise24%
    Large Enterprise18%
    VISITORS READING REVIEWS
    Small Business17%
    Midsize Enterprise16%
    Large Enterprise68%
    Buyer's Guide
    Cisco Secure Network Analytics vs. NetWitness XDR
    March 2024
    Find out what your peers are saying about Cisco Secure Network Analytics vs. NetWitness XDR and other solutions. Updated: March 2024.
    765,386 professionals have used our research since 2012.

    Cisco Secure Network Analytics is ranked 3rd in Network Detection and Response (NDR) with 57 reviews while NetWitness XDR is ranked 6th in Network Detection and Response (NDR) with 15 reviews. Cisco Secure Network Analytics is rated 8.2, while NetWitness XDR is rated 8.0. The top reviewer of Cisco Secure Network Analytics writes "Increased the visibility of what is happening in our network". On the other hand, the top reviewer of NetWitness XDR writes "Beneficial single unified dashboard, good native application integration, and high availability". Cisco Secure Network Analytics is most compared with Darktrace, Cisco Secure Cloud Analytics, ThousandEyes, Vectra AI and Arista NDR, whereas NetWitness XDR is most compared with Darktrace, ExtraHop Reveal(x), CrowdStrike Falcon, Microsoft Defender for Endpoint and SentinelOne Singularity Complete. See our Cisco Secure Network Analytics vs. NetWitness XDR report.

    See our list of best Network Detection and Response (NDR) vendors.

    We monitor all Network Detection and Response (NDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.