Try our new research platform with insights from 80,000+ expert users

Elastic Observability vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Elastic Observability
Ranking in Log Management
16th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
27
Ranking in other categories
Application Performance Monitoring (APM) and Observability (7th), IT Infrastructure Monitoring (11th), Container Monitoring (4th), Cloud Monitoring Software (7th)
NetWitness Platform
Ranking in Log Management
38th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
37
Ranking in other categories
Security Information and Event Management (SIEM) (29th)
 

Mindshare comparison

As of June 2025, in the Log Management category, the mindshare of Elastic Observability is 1.3%, down from 2.1% compared to the previous year. The mindshare of NetWitness Platform is 0.3%, down from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management
 

Featured Reviews

Adelina Craciun - PeerSpot reviewer
Customization enables tailored monitoring and alerting across departments
The possibility to customize it has been quite useful. Whatever the other departments want to dream up, we implement. Whatever they want to monitor, the granularity of it, the changes in the threshold, and the anomalies that they want reported all require some development. So far, every single request has been fulfilled.
MOTASHIM Al Razi - PeerSpot reviewer
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The tool's most valuable feature is centralized logging. Elastic Common Search helps us to search for the logs across the organization."
"We use AppDynamics and Elastic. The reason why we're using Elastic APM is because of the license count. It's very favorable compared to AppDynamics. It's inexpensive; it's economical."
"Elastic provides built-in features for queries and report generation. It's a very good tool for monitoring integration capabilities."
"I think Elastic Observability is already in very good shape."
"The most valuable feature of Elastic Observability is the text search."
"The most valued feature of Elastic is its log analytics capabilities."
"Its diverse set of features available on the cloud is of significant importance."
"All the features that we use, such as monitoring, dashboarding, reporting, the possibility of alerting, and the way we index the data, are important."
"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."
"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."
"The most valuable features are the packet inspection and the automated incident response."
"It gives the ability to investigate into network traffic in the Net and the organization what we couldn't do before."
"Offers a good wireless feature."
"The most valuable feature is the hunting ability to work in a CERT."
"The most valuable features are its ingestion of logs and raising of alerts based on those logs."
"The product's initial setup phase was not at all difficult."
 

Cons

"One example is the inability to monitor very old databases with the newest version."
"Elastic Observability’s price could be improved."
"The cost must be made more transparent."
"The tool's scalability involves a more complex implementation process. It requires careful calculations to determine the number of nodes needed, the specifications of each node, and the configuration of hot, warm, and cold zones for data storage. Additionally, managing log retention policies adds further complexity. The solution's pricing also needs to be cheaper."
"Elastic Observability is an excellent product for monitoring and visibility, but it lacks predictive analytics. Most solutions are aligned with the AIOps requirements, but this piece is missing in Elastic and should be included."
"They need more skills in the market. There are not enough skills in the market. It is not pervasive enough on the market, in my opinion. In other words, there isn't a big enough user base."
"Simplifying the parsing of logs and manual efforts would also be beneficial."
"More web features could be added to the product."
"The product's licensing models are complex to understand. This particular area needs improvement."
"Technical support could be improved."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"The initial setup is complex. There are other solutions that are easier to implement."
"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."
"Nowadays, their support is a little subpar compared to other solutions. I rate RSA support six out of 10."
"Log aggregation is an issue with this solution because there are a huge number of alerts in a single instance."
"The tool's integration capability isn't so great."
 

Pricing and Cost Advice

"So far, there are just the standard licensing fees. Several of the components are embedded in the license or are even open source. They're even free depending on what you use, which makes it even more appealing to someone that is discussing pricing of the solution."
"There are two types: cloud and SaaS. They charge based on data ingestion, ingest rate, hard retention, and warm retention. I believe it costs around $25,000 annually to ingest 30GB of data daily. That is the SaaS version. There is also a self-managed license where the customer manages their own infrastructure on-prem. In such cases, there are three license tiers that respectively cost $5,000 annually per node, $7,000 per node, and $12,500 per node."
"Pricing is one of those situations where the more you use it, the more you pay."
"We have been using the open-source version."
"We will buy a premium license after POC."
"Users have to pay for some features, like the alerts on different channels, because they are unavailable in different source versions."
"Elastic Observability is cheaper than other similar solutions, such as Dynatrace. Its license calculation is based on various factors like data volume and physical infrastructure, particularly related to RAM capacity."
"One needs to pay for the licenses, and it is an annual subscription model right now."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"This is a pricey solution; it's not cheap."
"We are on an annual license for the use of the solution."
"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."
"It is cheap."
"Compared to the competition, the is price is not that high."
"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
859,129 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Computer Software Company
15%
Manufacturing Company
8%
Government
6%
Computer Software Company
18%
Financial Services Firm
18%
Government
5%
Manufacturing Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Elastic Observability?
Elastic Observability significantly improves incident response time by providing quick access to logs and data across various sources. For instance, searching for specific keywords in logs spanning...
What is your experience regarding pricing and costs for Elastic Observability?
The license for Elastic Observability is the same as for other uses; you pay for Elastic, and you can use it for various cases. Observability is actually cheaper compared to logs because you're not...
What needs improvement with Elastic Observability?
I think they are working on the AI-based features, which are currently in technical preview. The only challenging aspect for new users is often writing the query language. Basic searching is very e...
What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
 

Also Known As

No data available
RSA Security Analytics
 

Overview

 

Sample Customers

PSCU, Entel, VITAS, Mimecast, Barrett Steel, Butterfield Bank
Los Angeles World Airports, Reply
Find out what your peers are saying about Elastic Observability vs. NetWitness Platform and other solutions. Updated: June 2025.
859,129 professionals have used our research since 2012.