Try our new research platform with insights from 80,000+ expert users

Elastic Observability vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Elastic Observability
Ranking in Log Management
16th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
27
Ranking in other categories
Application Performance Monitoring (APM) and Observability (7th), IT Infrastructure Monitoring (11th), Container Monitoring (4th), Cloud Monitoring Software (6th)
NetWitness Platform
Ranking in Log Management
35th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
37
Ranking in other categories
Security Information and Event Management (SIEM) (31st)
 

Mindshare comparison

As of August 2025, in the Log Management category, the mindshare of Elastic Observability is 1.3%, down from 2.1% compared to the previous year. The mindshare of NetWitness Platform is 0.4%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management
 

Featured Reviews

Adelina Craciun - PeerSpot reviewer
Customization enables tailored monitoring and alerting across departments
The possibility to customize it has been quite useful. Whatever the other departments want to dream up, we implement. Whatever they want to monitor, the granularity of it, the changes in the threshold, and the anomalies that they want reported all require some development. So far, every single request has been fulfilled.
MOTASHIM Al Razi - PeerSpot reviewer
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I recommend Elastic Observability for its completeness of vision and wide ecosystem."
"It is very stable, and I would rate it ten out of ten based on my interaction with it."
"The product has connectors to many services."
"The Elastic User Interface framework lets us do custom development when needed. You need to have some Javascript knowledge. We need that knowledge to develop new custom tests."
"Elastic APM has plenty of features, such as the Elastic server for Kibana and many additional plugins. It's a comprehensive tool when used as a logging platform."
"The architecture and system's stability are simple."
"I think Elastic Observability is already in very good shape."
"The solution has been stable in our usage."
"What we are mainly using are the RSA concentrator, RSA Decoder, Archiver, Broker, and Log Decoder."
"The most valuable feature is the ability to write rules and triggers for network communication, and then being able to investigate based on that."
"The solution is really scalable for the high-end power, enterprise customer."
"The most valuable features are the packet decoder, log decoder, and concentrator."
"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."
"The most valuable features are the packet inspection and the automated incident response."
"The most valuable feature is the correlation. It can report in real-time and monitor the management."
"It gives the capability for the incident response team to correlate logs to identify any kind of problem like malware and incidents in a general sense, both for logs and packets."
 

Cons

"The solution would be better if it was capable of more automation, especially in a monitoring capacity or for the response to abnormalities."
"Elastic Observability is reactive rather than proactive. It should act as an ITSM tool and be able to create tickets and alerts on Jira."
"Elastic APM's visualization is not that great compared to other tools. It's number of metrics is very low."
"The only challenging aspect for new users is often writing the query language."
"I am familiar with Azure Monitor, which I find more user-friendly compared to Elastic, which is a very technical tool."
"The interface could be improved."
"When opening tickets, we cannot use our team mailbox."
"There could be more low-code features included in the product."
"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."
"More customizability is required, which is something that they need to improve on."
"Security needs improvement."
"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."
"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."
"The product's licensing models are complex to understand. This particular area needs improvement."
 

Pricing and Cost Advice

"The product’s pricing needs improvement."
"The price of Elastic Observability is expensive."
"Users have to pay for some features, like the alerts on different channels, because they are unavailable in different source versions."
"Elastic Observability's pricing could be better for small-scale users."
"So far, there are just the standard licensing fees. Several of the components are embedded in the license or are even open source. They're even free depending on what you use, which makes it even more appealing to someone that is discussing pricing of the solution."
"Elastic Observability is cheaper than other similar solutions, such as Dynatrace. Its license calculation is based on various factors like data volume and physical infrastructure, particularly related to RAM capacity."
"Since we are a huge company, Elastic Observability is an affordable solution for us."
"Pricing is one of those situations where the more you use it, the more you pay."
"The product is expensive."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"The product price was reasonable for my region and the market."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"It’s cheaper to run virtual machines in a VMware environment."
"Compared to the competition, the is price is not that high."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
865,384 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
18%
Computer Software Company
15%
Manufacturing Company
8%
Government
6%
Financial Services Firm
14%
Computer Software Company
13%
Comms Service Provider
6%
Manufacturing Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Elastic Observability?
Elastic Observability significantly improves incident response time by providing quick access to logs and data across various sources. For instance, searching for specific keywords in logs spanning...
What is your experience regarding pricing and costs for Elastic Observability?
The license for Elastic Observability is the same as for other uses; you pay for Elastic, and you can use it for various cases. Observability is actually cheaper compared to logs because you're not...
What needs improvement with Elastic Observability?
I think they are working on the AI-based features, which are currently in technical preview. The only challenging aspect for new users is often writing the query language. Basic searching is very e...
What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
 

Also Known As

No data available
RSA Security Analytics
 

Overview

 

Sample Customers

PSCU, Entel, VITAS, Mimecast, Barrett Steel, Butterfield Bank
Los Angeles World Airports, Reply
Find out what your peers are saying about Elastic Observability vs. NetWitness Platform and other solutions. Updated: July 2025.
865,384 professionals have used our research since 2012.