Devo vs NetWitness Platform comparison

Devo and NetWitness are both solutions in the Log Management category. Devo is ranked #18 with an average rating of 8.3, while NetWitness is ranked #37 with an average rating of 8.0. Devo holds a 1.4% mindshare in Log Management, compared to NetWitness’s 1.1% mindshare. Additionally, 92% of Devo users are willing to recommend the solution, compared to 75% of NetWitness users who would recommend it.

Devo

Read 26 Devo reviews

6,972 Views
3,625 Comparison Views

92% willing to recommend

NetWitness Platform

Read 36 NetWitness Platform reviews

5,586 Views
2,681 Comparison Views

75% willing to recommend

Devo

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 3, 2026

NetWitness Platform and Devo are competing products in the cybersecurity solutions category. Devo seems to have the upper hand due to its integration capabilities and scalability benefits.

Features: NetWitness Platform provides advanced threat detection, incident response, and rule creation for security events. Devo focuses on real-time data analytics, ease of integration, and Activeboards for custom dashboards.

Room for Improvement: NetWitness could improve on simplifying its deployment model, enhancing user interface intuitiveness, and reducing initial setup time. Devo could benefit from expanding its real-time alerting capabilities, providing more intuitive navigation in its interface, and lower costs for licensing and long-term data retention.

Ease of Deployment and Customer Service: NetWitness Platform requires substantial initial setup due to its complex deployment model, whereas Devo offers a streamlined, cloud-based deployment, minimizing setup complexity. While NetWitness provides robust customer service, Devo’s customer support is noted for faster issue resolution and onboarding.

Pricing and ROI: NetWitness Platform generally involves higher setup costs with complex licensing models, but it provides ROI through intelligence-driven security solutions. Devo offers a more cost-effective solution with lower initial costs, delivering substantial ROI through rapid deployment and high-value data analytics. Devo provides a more accessible entry point while maintaining functionality, in contrast to NetWitness, which is favored by organizations seeking comprehensive on-premise solutions.

To learn more, read our detailed Devo vs. NetWitness Platform Report (Updated: August 2026).

Buyer's Guide

Devo vs. NetWitness Platform

August 2026

Download the complete report

Helped 909,725 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Devo

Ranking in Log Management

18th

Ranking in Security Information and Event Management (SIEM)

18th

Average Rating

8.4

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

IT Operations Analytics (7th), AIOps (13th)

NetWitness Platform

Ranking in Log Management

37th

Ranking in Security Information and Event Management (SIEM)

36th

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of August 2026, in the Log Management category, the mindshare of Devo is 1.4%, up from 0.6% compared to the previous year. The mindshare of NetWitness Platform is 1.1%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management Mindshare Distribution
Product	Mindshare (%)
Devo	1.4%
NetWitness Platform	1.1%
Other	97.5%

Log Management

Featured Reviews

Usama Khan

Team Lead SOC at a tech services company with 51-200 employees

Advanced threat hunting has improved SOC visibility and now supports faster incident response

Devo can improve in how its connectors enhance integration with third-party tools. Devo's architecture works by having you deploy a relay server in the data center of the client side and Devo SIEM is basically on the AWS cloud. There are specific ports which are enabled on the relay server, which are 514 and 13000, 13151, 152. However, when we talk about databases and custom integrations, there are not default ports in the relay server. No default ports are defined. For JDBC drivers, the port number is 1433, but it is not in the relay server. You have to add it manually. For Oracle RDBMS, the port is 1521, and it is also not there by default. I would appreciate more third-party integrations including Fortinet and others. Machine learning models can also be improved. Playbooks in the SOAR can also be improved. Regarding playbooks for automation, we utilize playbooks for automation in SOAR for automated IOC blocking on a firewall, on a web application firewall, on DNS security, etc. The only option for us to run the playbook is to schedule the job for it. However, if I want to manually run the playbook, there is no option for doing so. This needs improvement.

Read full review

reviewer2256927

Head of Information Security, Cyber Defense and IT Risk Management at HCT. at a transportation company with 201-500 employees

A solid SIEM solution that should improve technical support and online resources to be easier to use

A big problem with the product is that we don't have much professional experience in Israel installing, implementing, and integrating this product. There is not enough of a knowledge base. There is no support for this product in this country, so problems have to be resolved through global technical teams. We like to work locally because of the language, and when the product is only supported outside the country, it's a little difficult to implement and use this product. Moreover, AI is something that must be added immediately. Artificial intelligence is a part of the competitors' products, and it's not been implemented for us.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We can ingest virtually any log source, which is much better than our previous solution."

"The alerting is much better than I anticipated. We don't get as many alerts as I thought we would, but that nobody's fault, it's just the way it is."

"Those 400 days of hot data mean that people can look for trends and at what happened in the past. And they can not only do so from a security point of view, but even for operational use cases. In the past, our operational norm was to keep live data for only 30 days. Our users were constantly asking us for at least 90 days, and we really couldn't even do that. That's one reason that having 400 days of live data is pretty huge. As our users start to use it and adopt this system, we expect people to be able to do those long-term analytics."

"The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable."

"The querying and the log-retention capabilities are pretty powerful. Those provide some of the biggest value-add for us."

"Being able to build and modify dashboards on the fly with Activeboards streamlines my analyst time because my analysts aren't doing it across spreadsheets or five different tools to try to build a timeline out themselves. They can just ingest it all, build a timeline out across all the logging, and all the different information sources in one dashboard. So, it's a huge time saver. It also has the accuracy of being able to look at all those data sources in one view. The log analysis, which would take 40 hours, we can probably get through it in about five to eight hours using Devo."

"I'm so happy with the platform."

"Devo's speed and performance allows us to query in real-time and keep up with what is actually happening on the network, then respond effectively to events."

More Devo pros

"RSA NetWitness is a SIEM and real-time network traffic solution that collects logs and packets, applies a set of alerting, reporting, and analysis rules on them, and thus provides the enterprise with full visibility of the networks and activities of the systems."

"NetWitness Platform is valuable for creating rules that the solution must detect."

"It gives the ability to investigate into network traffic in the Net and the organization what we couldn't do before."

"It's quite economical compared to other solutions in the market."

"It gives the capability for the incident response team to correlate logs to identify any kind of problem like malware and incidents in a general sense, both for logs and packets."

"The software is scalable to whatever is required, and you can also put a lot of resources in the cloud."

"The most valuable feature is the correlation, as it can report in real-time and monitor the management."

"The most valuable feature is the hunting ability to work in a CERT."

More NetWitness Platform pros

Cons

"There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness."

"The overall performance of extraction could be a lot faster, but that's a common problem in this space in general. Also, the stock or default alerting and detecting options could definitely be broader and more all-encompassing. The fact that they're not is why we had to write all our own alerts."

"There is room for improvement in the ability to parse different log types. I would go as far as to say the product is deficient in its ability to parse multiple, different log types, including logs from major vendors that are supported by competitors. Additionally, the time that it takes to turn around a supported parser for customers and common log source types, which are generally accepted standards in the industry, is not acceptable. This has impacted customer onboarding and customer relationships for us on multiple fronts."

"One improvement area for Devo could be simplifying some configuration and improving the onboarding for new analysts because it is quite complex for fresher or new analysts who are handling Devo."

"Some third-parties don't have specific API connectors built, so we had to work with Devo to get the logs and parse the data using custom parsers, rather than an out-of-the-box solution."

"The Activeboards feature is not as mature regarding the look and feel. Its functionality is mature, but the look and feel is not there. For example, if you have some data sets and are trying to get some graphics, you cannot change anything. There's just one format for the graphics. You cannot change the size of the font, the font itself, etc."

"The biggest area with room for improvement in Devo is the Security Operations module that just isn't there yet."

"One major area for improvement for Devo... is to provide more capabilities around pre-built monitoring. They're working on integrations with different types of systems, but that integration needs to go beyond just onboarding to the platform. It needs to include applications, out-of-the-box, that immediately help people to start monitoring their systems. Such applications would include dashboards and alerts, and then people could customize them for their own needs so that they aren't starting from a blank slate."

More Devo cons

"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."

"Security needs improvement."

"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."

"Health monitoring of the event sources and devices."

"The documentation is not as structured as I would like, personally, and I think that it can be improved and made much more user-friendly."

"RSA NetWitness Logs and Packets is far behind the competition."

"I cannot say that the solution was stable because it tended to crash."

"An area for improvement would be better automation and more inbuilt use cases."

More NetWitness Platform cons

Pricing and Cost Advice

"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."

"It's very competitive. That was also a primary draw for us. Some of the licensing models with solutions like Splunk and Sentinel were attractive upfront, but there were so many micro-charges and services we would've had to add on to make them what we wanted. We had to include things like SOAR and extended capabilities, whereas all those capabilities are completely included with the Devo platform. I haven't seen any additional fee."

"Devo was very cost-competitive... Devo did come with that 400 days of hot data, and that was not the case with other products."

"The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this point they do, but when we first negotiated with them, there were only three or four tiers."

"Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."

"Our licensing fees are billed annually and per terabyte."

"Pricing is based on the number of gigabytes of ingestion by volume, and it's on a 30-day average. If you go over one day, that's not a big deal as long as the average is what you expected it to be."

"[Devo was] in the ballpark with at least a couple of the other front-runners that we were looking at. Devo is a good value and, given the quality of the product, I would expect to pay more."

More Devo pricing and cost advice

"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."

"This is a pricey solution; it's not cheap."

"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."

"It’s cheaper to run virtual machines in a VMware environment."

"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."

"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."

"Compared to the competition, the is price is not that high."

"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

909,725 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

15%

Construction Company

10%

Outsourcing Company

Manufacturing Company

Construction Company

13%

Financial Services Firm

11%

Outsourcing Company

10%

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	5
Large Enterprise	12

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	7
Large Enterprise	20

Questions from the Community

What is your experience regarding pricing and costs for Devo?

The pricing of the product is reasonable if we compare it with other Gartner leading products like Splunk, LogRhythm, Microsoft Sentinel, Google SecOps. Its licensing model is basically on per-day ...

See all answers

What needs improvement with Devo?

See all answers

What is your primary use case for Devo?

I am using Devo myself. Basically, I work at an MSSP, and we provide services to the organization for Security Operation Centers. In our Security Operation Center, we provide the service of SIEM vi...

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

See all answers

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

See all answers

What is your primary use case for NetWitness Platform?

I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.

See all answers

Comparisons

Splunk Enterprise Security vs Devo

Compared 8% of the time

LogRhythm SIEM vs Devo

Compared 7% of the time

New Relic vs Devo

Compared 4% of the time

IBM Security QRadar vs Devo

Compared 3% of the time

Datadog vs Devo

Compared 3% of the time

More Devo Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 7% of the time

IBM Security QRadar vs NetWitness Platform

Compared 7% of the time

Idira Privileged Access Manager vs NetWitness Platform

Compared 6% of the time

Palo Alto Networks WildFire vs NetWitness Platform

Compared 6% of the time

RSA enVision vs NetWitness Platform

Compared 5% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

Devo

August 2026

Download Devo product report

Buyer's Guide

NetWitness Platform

August 2026

Download NetWitness Platform product report

Also Known As

No data available

RSA Security Analytics

Overview

Devo offers powerful visual analytics, real-time data querying, and log integration capabilities within a cloud-native, multi-tenant architecture, supporting extended data retention ideal for long-term analysis and compliance.

Devo is recognized for its Activeboards, which facilitate visual analytics. High-speed search capabilities and real-time analytics enable efficient data manipulation and querying. Its multi-tenant architecture supports effective data segregation and customization tailored to distinct business needs, enhancing its value for handling complex log integrations. With extended data retention of 400 days and a cloud-native architecture, Devo is a robust platform for long-term analysis and compliance requirements. Though opportunities exist to improve browser stability on large searches, SOAR integrations, and its parser capabilities, Devo remains essential for incident response and security monitoring, offering centralized data storage and analysis.

What are Devo's most important features?

Activeboards: Facilitate visual analytics and data exploration.
High-Speed Search: Enables fast data querying and manipulation.
Real-Time Analytics: Supports instant insights and decision-making.
Multi-Tenant Architecture: Allows effective data segregation and customization.
Extended Data Retention: Offers 400-day log retention for compliance and analysis.
Complex Log Integration: Handles intricate data sources effortlessly.

What benefits and ROI should organizations look for in reviews?

Visual Insights: Enhance understanding through interactive dashboards.
Performance Efficiency: Saves time with high-speed data search and real-time results.
Customization Flexibility: Fits specific business requirements with multi-tenant architecture.
Long-Term Compliance: Ensures alignment with extended data retention needs.
Centralized Monitoring: Enables comprehensive incident response and security monitoring.

Devo is extensively used in industries focused on incident response and digital forensics, centralizing data for security monitoring across hybrid environments. Organizations benefit from its ability to store and analyze aggregated logs, creating alerts and dashboards to enhance visibility for network and endpoint activities in multi-domain settings.

Devo

NetWitness Platform provides seamless threat intelligence integration and robust log/packet ingestion. It enhances network visibility and incident management through automated threat detection, ideal for enterprises seeking scalability and security intelligence.

NetWitness Platform offers a comprehensive suite of tools designed to tackle security challenges within Security Operations Centers. It integrates data from endpoints, networks, and other sources, ensuring in-depth security analysis. By supporting features like XDR and UEBA, it grants a unified view of security events. Its capabilities extend to threat hunting, malware analysis, and network forensics, assisting organizations in managing incidents, ensuring compliance with regulations like GDPR, and detecting cyber threats. Users appreciate its ease of deployment, flexibility, and threat prediction capabilities, although improvements in integration, documentation, and AI are desired.

What are the key features of NetWitness Platform?

User-friendly Interface: Simplifies security monitoring and management.
Threat Intelligence Integration: Provides seamless access to threat data.
Log/Packet Ingestion and Alerting: Enhances detection and response.
Network Visibility: Improves threat detection across networks.
Incident Management: Streamlines response to security incidents.
Automated Threat Detection: Facilitates quick identification of threats.
Custom Connectors: Allows for tailored integrations.
Advanced Dashboarding and Reporting: Offers detailed insights.
Packet/Incident Correlation: Enhances understanding of threats.

What benefits can users expect when evaluating NetWitness Platform?

Threat Prediction: Anticipates potential vulnerabilities.
Ease of Use: Streamlines user experience.
Deployment Flexibility: Adapts to organizational structure.
Scalability: Supports growing security infrastructure needs.
Security Intelligence: Enhances awareness and response capabilities.

In finance and health sectors, NetWitness Platform aids significantly by providing comprehensive threat analysis, ensuring compliance, and facilitating rapid incident management. Enterprises in these industries benefit by maintaining robust security postures and meeting regulatory demands.

NetWitness

Sample Customers

United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel

Los Angeles World Airports, Reply

Buyer's Guide

Devo vs. NetWitness Platform

August 2026

Free Report: Devo vs. NetWitness Platform

Find out what your peers are saying about Devo vs. NetWitness Platform and other solutions. Updated: August 2026.

DOWNLOAD NOW

909,725 professionals have used our research since 2012.

See our Devo vs. NetWitness Platform report.

See our list of best Log Management vendors and best Security Information and Event Management (SIEM) vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.