No more typing reviews! Try our Samantha, our new voice AI agent.

CrowdStrike Falcon vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 11, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

CrowdStrike Falcon
Ranking in Security Information and Event Management (SIEM)
6th
Average Rating
8.6
Reviews Sentiment
7.3
Number of Reviews
138
Ranking in other categories
Endpoint Protection Platform (EPP) (1st), Threat Intelligence Platforms (TIP) (1st), Endpoint Detection and Response (EDR) (1st), Extended Detection and Response (XDR) (1st), Attack Surface Management (ASM) (1st), Identity Threat Detection and Response (ITDR) (1st), AI-Powered Cybersecurity Platforms (1st)
NetWitness Platform
Ranking in Security Information and Event Management (SIEM)
33rd
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Log Management (34th)
 

Mindshare comparison

As of March 2026, in the Security Information and Event Management (SIEM) category, the mindshare of CrowdStrike Falcon is 3.1%, down from 4.5% compared to the previous year. The mindshare of NetWitness Platform is 0.9%, up from 0.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM) Mindshare Distribution
ProductMindshare (%)
CrowdStrike Falcon3.1%
NetWitness Platform0.9%
Other96.0%
Security Information and Event Management (SIEM)
 

Featured Reviews

Waleed Omar - PeerSpot reviewer
Information Security Specialist at Arab Open University
Provides effective real-time threat detection with potential for cost optimization
Some features such as device control, firewall management, and file analysis are standalone products that we need to purchase separately. If these features came out of the box within the product, it would be much more beneficial for us. Other providers such as SentinelOne include these features in their base product. We attended a CrowdStrike Falcon event where they discussed some shallow AI features, but we cannot see these in our panel yet. We work with different solutions such as Darktrace and SocRadar, where AI features are automatically displayed in our dashboards after release. However, for CrowdStrike Falcon, we cannot see these features.
MOTASHIM Al Razi - PeerSpot reviewer
CISO at One Bank Limited
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We have been completely happy with the solution that we have been running on for years now and have never regretted our decision."
"Regarding features, I appreciate its integration capabilities with identity providers...Stability-wise, I rate the solution a ten out of ten."
"The EDR feature of CrowdStrike is fantastic."
"We have seen a reduction to the performance hit to our operating systems."
"We receive good ROI when using this solution."
"The product's deployment phase is easy."
"CrowdStrike's advantage is that the agent is light, so it doesn't require many resources on the machines, it's easy to install, and the results are useful to the organization."
"At this point what is most valuable is the interface, which is easy to navigate."
"Overall, I feel that the product is very good and my biggest complaint is about their support."
"Since the solution has been under way we have seen a large decrease of threats and proactive reactions to incidents."
"The newer 11.5 version that my team is using has found it to have good mapping."
"The most valuable features are the packet decoder, log decoder, and concentrator."
"The product's initial setup phase was not at all difficult."
"The software is scalable to whatever is required, and you can also put a lot of resources in the cloud."
"Overall, this is a good solution with suitable features and it very well fits our needs."
"Setting up NetWitness is straightforward; there are multiple connectors, including standard and specialized connectors, with enhanced capability to integrate custom applications, and from there you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
 

Cons

"The UI is not efficient."
"There are some aspects of the UI that could use some improvement, e.g., working in groups. I build a group, then I have to manually assign prevention policies, update policies, etc., but there is no function to copy that group. So, if I wanted to make a subgroup for troubleshooting or divide workstations into groups of laptops and desktops, then I have to manually build a brand new group. I can't just copy a build from one to another. Additionally, in order to do any work within a group, I have to first do the work on the respective prevention policy page or individual policy page, then remove the group if the group is assigned to a different prevention policy, remove the prevention policy, and then add the new one in. So, it can get a little hectic. It would be easier if I could add and remove things from the group page rather than having to go into the policy pages to do it."
"They offered a white glove service that was extremely costly. When we got into it, we saw it was relatively easy. If I was being nitpicky, I'd say that I don't like being sold something that's unnecessary. That's the only downside I've seen to the solution."
"On the firewall management side, there should be more granularity. There should also be more granularity for device control. Everything else is brilliant."
"The price is too high."
"I would like them to improve the correlation of data in the search algorithms. When we run an investigation, malware, phishing, etc., I want to look at multiple endpoints at once to correlate that data to see the likenesses, e.g., how are they not alike or what systems and processes are running across those systems? I don't want to have to run the same search in their Spotlight module five, 10, 15, or 100 times to get 100 different results, copy that data out, and then correlate it on my own. In a very simple way, I want to be able to load up a comma-delimited list giving me the spotlight data on these X amount of hosts, letting me search for it quickly. We have had to go back to CrowdStrike, and say, "Our search are taking far too long for even one host." They did bump up the cores and that did improve performance, but it is still kind of slow to get that Spotlight data. That is probably our biggest pain point. I think that needs some help. I understand this kind of information access is probably not the easiest thing to do. It is probably a big ask depending on how their back-end is setup."
"To simplify the budgeting process for our clients, CrowdStrike should consider offering bundled packages that include essential features."
"I think there's an opportunity to enhance the AI or at least the traps to say, if something changes from this baseline, let us know and flag it."
"Health monitoring of the event sources and devices."
"Security needs improvement."
"I cannot say that the solution was stable because it tended to crash."
"An area for improvement would be better automation and more inbuilt use cases."
"The tool's integration capability isn't so great."
"The solution is pretty complex to set up. Comparatively, I have worked on IBM QRadar and Splunk; they are much easier to set up."
"I believe that integrating the solution with other products such as Oracle would be beneficial."
"The log system is a bit complex and has room for improvement."
 

Pricing and Cost Advice

"In my opinion, the pricing of CrowdStrike Falcon seems aggressive."
"I would like them to further reduce the price, because it is quite pricey at the moment."
"The price of CrowdStrike Falcon is expensive and should be reduced."
"I do not have experience with the cost or licensing of the product."
"All I can say about the licensing cost is that it's negotiable."
"There is an annual license required to use this solution."
"The pricing is not bad. It's on the higher end of the market, but you get what you pay for."
"The solution's pricing is great for us."
"The licenses are good but the cost is very expensive."
"The tool is very expensive, so I rate the pricing a ten out of ten. The solution has an annual subscription."
"We are on an annual license for the use of the solution."
"It’s cheaper to run virtual machines in a VMware environment."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"The product price was reasonable for my region and the market."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
885,311 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Computer Software Company
11%
Financial Services Firm
10%
Manufacturing Company
10%
Government
6%
Financial Services Firm
11%
Performing Arts
8%
Comms Service Provider
7%
Outsourcing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business50
Midsize Enterprise33
Large Enterprise62
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions that are very scalable, secure, and user-friendly. Cortex XDR by Palo Alto offers ...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing user interface that makes setup easy and seamless. CrowdStrike Falcon offers a cl...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never push your machine hardware to "test", you don't have the usual "scan now" feature ...
What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
 

Also Known As

CrowdStrike Falcon XDR, CrowdStrike Falcon Threat Intelligence, CrowdStrike Identity Protection, CrowdStrike Falcon Surface, CrowdStrike Falcon Platform
RSA Security Analytics
 

Overview

 

Sample Customers

Information Not Available
Los Angeles World Airports, Reply
Find out what your peers are saying about CrowdStrike Falcon vs. NetWitness Platform and other solutions. Updated: March 2026.
885,311 professionals have used our research since 2012.