We performed a comparison between Forescout Platform and NetWitness XDR based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.
Features: Forescout Platform stands out for its agentless visibility and advanced features like device fingerprinting. NetWitness XDR is commended for its prompt threat response, seamless integration capabilities, and user behavior analytics. Forescout users say the product could be better at resolving connectivity and license issues. Users want better device compatibility and troubleshooting tools. NetWitness XDR could improve its threat intelligence and investigation. Some users suggested updates to its reporting engine.
Service and Support: Some users reported positive experiences with Forescout support, but others requested better responsiveness and training. NetWitness XDR provides effective 24/7 technical support. While some were satisfied with the response times, others experienced delays of up to 48 hours.
Ease of Deployment: Some users found Forescout’s setup to be simple and adaptable, while others perceived it as more complex and time-intensive. Some users found the initial setup of NetWitness uncomplicated, but others faced challenges.
Pricing: The total cost of Forescout Platform can be high depending on the level of customization and integration required. NetWitness XDR licensing is based on the number of endpoints. Larger users can receive discounts, but users say the solution might be too pricey for smaller companies. NetWitness XDR provides various licenses, including some that feature premium support
ROI: Forescout Platform yields a solid ROI by improving network access control and overall security. NetWitness XDR has demonstrated positive outcomes by improving threat detection capabilities and facilitating digital forensics.
Comparison Results: Users prefer Forescout Platform over NetWitness XDR. Forescout provides agentless visibility and users like its device fingerprinting feature, which makes it easier for organizations to protect their entire environment without the need to add devices manually. The platform also offers granular configuration, comprehensive visibility, and excellent customer service. NetWitness XDR has mixed reviews for its initial setup, slower performance, and complicated licensing.
"The unified view of the threat landscape on a central dashboard is the most valuable feature."
"Scanning, vulnerability reporting, and the dashboard are the most valuable features."
"I have found the ability to delete unwanted threats beneficial."
"The attack simulation is excellent; initially, this feature wasn't very robust, but Microsoft improved what we could achieve with it. We can now customize our practice phishing emails and include our company logo, for example. Attack simulation also helps integrate with third-party solutions where applicable and provides an overview of our security architecture through testing. The summary includes areas for improvement in our protection and what steps we need to take to get there."
"The incident threat response and its ability to facilitate effective remediation against threats are the standout features."
"It has great stability."
"The most valuable features are spam filtering, attachment filtering, and antivirus protection."
"The most valuable features of Microsoft 365 Defender are the combination of all the capabilities and centralized management."
"The initial setup is quite simple. It's not too complex or difficult to set up."
"It has helped with improving our security posture in terms of controlling the access of rogue devices into our network through identification. We have been able to prevent rogue device activities on the network, check the health of the system, and ensure remediation."
"Provides a good overview of all devices on a network."
"Forescout Platform's best feature is plug-in integration."
"The user interface is quite simple."
"This solution can be used to organize guest portals, integrate switches, and create policies. Some of its standard use cases also include completing key process upgrades and anti-virus of Windows OS."
"The initial setup is easy, taking no more than two or three weeks."
"The stability is amazing for the Forescout Platform. We have been using Forescout for four years, and no one complained about the stability."
"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."
"They have recently updated the features and the most valuable ones are the instant threat response, ease of use, web interface, integration, and easy access. RSA NetWitness Endpoint is very compatible with other solutions and technologies. However, they do not rely on third-party solutions and have most features built-in."
"Ability to isolate the machine when there are malicious files."
"The interface of this solution is very flexible and easy to use."
"The most valuable feature is the way it captures the traffic, and it contains every detail of the communication."
"We've contacted technical support several times. They've been very good. They have been able to help us resolve our issues."
"It is stable. We have been using it for some time, without any issues."
"RSA NetWitness does market analysis in a more granular form. It gives you full visibility."
"Microsoft 365 Defender does not have a unique package with emerging endpoint security technologies, such as EDR and XDR."
"There is no common area where we can manage all the policies for the EDR, third-party solutions, devices, servers, Windows, Mac, etc., but it's on the road map, and we ware waiting for that feature."
"I personally have not seen much evidence of how Defender can enhance the story of zero trust for enterprises."
"The advanced threat-hunting capabilities are phenomenal, and the security copilot enhances that, but some data elements could be better or have more context inside of the advanced tables themselves. The schemas feel a little limited to what they're building into the product. It's probably just a maturity thing. I imagine we'll see the features I want in the next year."
"Defender also lacks automated detection and response. You need to resolve issues manually. You can manage multiple Microsoft security products from a single portal, and all your security recommendations are in one place. It's easy to understand and manage. However, I wouldn't say Defender is a single pane of glass. You still need to switch between all of the available Microsoft tools. You can see all the alerts in one panel, but you can't automate remediation."
"The only issue I've had is, when it comes to deployment, the steps I must take around policy setup. That is challenging."
"The dashboard should be easier to use. There is also improvement needed in the reporting when it comes to exporting or scheduling reports."
"There should be better information for experts on features in the solution. What I see when reading about features in Microsoft 365 Defender is that it is always general information. If Microsoft could go deeper into details for the experts about how to use the tools, usage of it would be more familiar and it would be easier to use."
"We experienced some detection issues when checking compliance for the Sophos agent."
"Custom integrations need to be better."
"Definitely, having more third-party integration would be an improvement."
"Logging would be one area for improvement. When we're troubleshooting, there are not a lot of clear things on Google that we can look up for ourselves. When we have an issue with it, we have to call the company to get the vendors involved. The logging of Forescout is horrible compared to other things that we've used."
"If older network devices are used there can be some compatibility issues while using the Forescout Platform. Additionally, if the switches that are deployed in your infrastructure are not captured properly to the endpoints there might be some difficulties with Forescout Platform trying to monitor the network traffic. Traffic management is an area the vendor should work on."
"Forescout Platform could improve the costs of integrations."
"We have found that the agent-based authentication, available within this solution could be improved."
"The initial setup was complex."
"The solution lacks a reporting engine."
"The integration of the solution needs to be improved. The dashboard needs lots of updates as well. In the next release, we would like to see advanced fraud detection features."
"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious."
"The solution is modular, for example you can buy the RSA ePack, which you buy as a module is not part of the conduit solution. They could include it and have it as an all-in-one solution."
"The contamination feature could be improved."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"The deployment process is complex. I don't know why, but this solution will suddenly stop working. Logs stop coming. Often, one thing or another stops working. Most of the time, one of my team members is working with troubleshooting and working with technical support. Log passing is also one of the biggest challenge."
"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."
Forescout Platform is ranked 12th in Extended Detection and Response (XDR) with 69 reviews while NetWitness XDR is ranked 17th in Extended Detection and Response (XDR) with 15 reviews. Forescout Platform is rated 8.4, while NetWitness XDR is rated 8.0. The top reviewer of Forescout Platform writes "We can go granular on each endpoint, quarantine non-compliant machines, and target vulnerabilities through scripting". On the other hand, the top reviewer of NetWitness XDR writes "Beneficial single unified dashboard, good native application integration, and high availability". Forescout Platform is most compared with Cisco ISE (Identity Services Engine), Aruba ClearPass, Fortinet FortiNAC, Nozomi Networks and Armis, whereas NetWitness XDR is most compared with Darktrace, ExtraHop Reveal(x), CrowdStrike Falcon, SentinelOne Singularity Complete and Microsoft Defender for Endpoint. See our Forescout Platform vs. NetWitness XDR report.
See our list of best Extended Detection and Response (XDR) vendors.
We monitor all Extended Detection and Response (XDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
