Try our new research platform with insights from 80,000+ expert users

D3 Security vs NetWitness NDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Dec 5, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Torq
Sponsored
Ranking in Security Orchestration Automation and Response (SOAR)
8th
Average Rating
8.8
Reviews Sentiment
5.6
Number of Reviews
4
Ranking in other categories
AI-SOC (13th), AI-Powered Security Automation (2nd)
D3 Security
Ranking in Security Orchestration Automation and Response (SOAR)
17th
Average Rating
9.0
Reviews Sentiment
7.5
Number of Reviews
2
Ranking in other categories
Security Incident Response (8th), AI-Powered Security Automation (4th)
NetWitness NDR
Ranking in Security Orchestration Automation and Response (SOAR)
25th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (55th), Threat Intelligence Platforms (TIP) (40th), Endpoint Detection and Response (EDR) (57th), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (38th)
 

Mindshare comparison

As of January 2026, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of Torq is 4.9%, up from 4.5% compared to the previous year. The mindshare of D3 Security is 1.2%, up from 0.4% compared to the previous year. The mindshare of NetWitness NDR is 1.2%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR) Market Share Distribution
ProductMarket Share (%)
Torq4.9%
D3 Security1.2%
NetWitness NDR1.2%
Other92.7%
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

Nimrod Vardi - PeerSpot reviewer
Global IT Director at OpenWeb
Automation workflows have transformed our IT, enabling secure just-in-time access control
We work with them quite often, so we have a direct line regarding areas in Torq that have room for improvement. If we have a feature request, we can request it. I do not have anything in mind at the moment. We were a design partner for a short while, so we feel that they listen and that users of the system have an impact on the way the system is designed for the better. They have a new community, which is something that I personally suggested years ago. There are many people like me in different places and they might have already built the workflow that I need. Having the option to share workflows or to jump on a thread and say I have this need, did anyone ever build a workflow for it, is amazing. Someone would jump in and say yes, sure, here, take this workflow. I think this is an amazing thing and I really hope that the community will come alive because I think this is really powerful. This is something that I already suggested and it did happen eventually, and I am quite happy with it. I do not have any specific feature in mind that I have a need for at the moment.
Muhammad Aamir Riaz - PeerSpot reviewer
Senior Manager Security Operation Center at The Bank of Punjab
Useful for automation and reporting and has open API for seamless integration
It was easy to integrate the tool with our infrastructure because all the APIs are pre-built. We just created a drag-and-drop prompt to integrate the solution with our infrastructure. I rate the overall solution a ten out of ten. Everyone needs to evaluate this solution according to their organization's needs because it can integrate well, but this depends on the technology you already have in your organization. It is an automation tool for detection and response, and while integration is possible, using legacy products could create issues. Some legacy products are closed systems and do not expose their APIs to other vendors. In such cases, you could run into problems. If you are considering this solution, check which APIs are available before you proceed. Otherwise, you may get the solution, but you must spend time on integrations. They provide integration support, but it's not automatic; it will take time.
reviewer1799727 - PeerSpot reviewer
Manager, IT Security Operations at a non-profit with 11-50 employees
Reliable and good support but can be expensive
I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"As an analyst, it has demonstrated potential to reduce workforce requirements and time needed for related activities."
"Once I started to use the system and I saw the potential, it changed all of our work in IT."
"Using that one piece of AI, we auto-closed 511 cases in quarter four alone."
"What I appreciate most about Torq is that it is an essential part of our system."
"The solution's valuable feature is its GUI. It has more than 450 connectors, which are excellent for connecting devices and automating integration. The solution has all the features we need. We deployed it in our environment, and it's fully integrated. Thanks to their open APIs, the seamless integration makes everything work well together."
"It is an out-of-the-box automated integration with our 20 departments. We perform L1 LiveOps automatically through the portal."
"RSA NetWitness does market analysis in a more granular form. It gives you full visibility."
"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."
"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."
"It is stable. We have been using it for some time, without any issues."
"Technical support is knowledgeable."
"This solution allows us to locate the malware in real-time."
"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."
"It is very easy to use, and its usability is great. The use cases are also very easy. The visualizations of the use cases are magnificent. You cannot find this in any other solution. From my point of view, it is great."
 

Cons

"Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes."
"The initial deployment of Torq was not easy."
"It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet."
"The reporting, especially custom reporting, needs to be improved. Additionally, it would be better if it could be hosted on Linux."
"Reporting needs improvement. MTTR and MTTD metrics aren't directly available in playbooks and require manual effort to achieve."
"The threat intelligence could improve in RSA NetWitness Endpoint."
"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."
"The contamination feature could be improved."
"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"RSA NetWitness Network could improve on integration with non-native application integration."
"The solution is modular, for example you can buy the RSA ePack, which you buy as a module is not part of the conduit solution. They could include it and have it as an all-in-one solution."
"The solution lacks a reporting engine."
 

Pricing and Cost Advice

Information not available
Information not available
"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"I do not have any opinion on the pricing or licensing of the product."
"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
"It is highly scalable. It can be bought based on your requirements."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"It is an expensive product."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"We are on a three-year contract to use RSA NetWitness Network."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Computer Software Company
8%
Manufacturing Company
8%
Healthcare Company
7%
Comms Service Provider
27%
Computer Software Company
18%
University
10%
Outsourcing Company
8%
Financial Services Firm
10%
Computer Software Company
10%
Manufacturing Company
9%
Performing Arts
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
No data available
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise5
 

Questions from the Community

What needs improvement with Torq?
From our research and testing with the tool, we determined there need to be modifications and changes to train the LL...
What is your primary use case for Torq?
I used Torq for conducting one of the proof of evaluations for a vendor we are connected with. I am currently working...
What advice do you have for others considering Torq?
One of our members uses AWS, and we receive their feed. This involves triaging AWS-related logs. While I do not have ...
What needs improvement with D3 Security?
The reporting, especially custom reporting, needs to be improved. Additionally, it would be better if it could be hos...
What is your primary use case for D3 Security?
We use the tool for automation and reporting. It helps to automate our playbooks.
What advice do you have for others considering D3 Security?
It was easy to integrate the tool with our infrastructure because all the APIs are pre-built. We just created a drag-...
Ask a question
Earn 20 points
 

Comparisons

 

Also Known As

No data available
No data available
RSA ECAT, NetWitness Network
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

Information Not Available
S&P Global, Scotiabank, Cybereason, Cummins
ADP, Ameritas, Partners Healthcare
Find out what your peers are saying about D3 Security vs. NetWitness NDR and other solutions. Updated: December 2025.
881,082 professionals have used our research since 2012.