Graylog vs NetWitness Platform comparison

Graylog and NetWitness are both solutions in the Log Management category. Graylog is ranked #15 with an average rating of 7.0, while NetWitness is ranked #37 with an average rating of 8.0. Graylog holds a 6.5% mindshare in Log Management, compared to NetWitness’s 0.3% mindshare. Additionally, 95% of Graylog users are willing to recommend the solution, compared to 75% of NetWitness users who would recommend it.

Graylog

Read 21 Graylog reviews

9,223 Views
5,549 Comparison Views

95% willing to recommend

NetWitness Platform

Read 37 NetWitness Platform reviews

713 Views
124 Comparison Views

75% willing to recommend

Graylog

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 9, 2024

NetWitness Platform and Graylog are competing security solutions. NetWitness appears to hold the upper hand with its advanced analytical capabilities and comprehensive threat detection, whereas Graylog offers simplicity in deployment and strong log management efficiency.

Features: NetWitness Platform is known for advanced analytical capabilities, threat detection, and response functions, essential for large-scale environments. Its comprehensive threat intelligence helps in preemptive action against potential threats. Graylog is distinguished for efficient log management, powerful search capabilities, and flexibility due to its open-source nature, allowing for customization to fit user needs.

Room for Improvement: NetWitness could enhance reporting tools, incorporate user feedback more rapidly, and improve usability. Graylog could benefit from better integration with third-party tools, improvements to certain security features, and expanding its integrative capabilities.

Ease of Deployment and Customer Service: NetWitness has a complex deployment process that users find challenging, but it compensates with commendable customer service, which supports smoother transitions. Graylog stands out for its easy installation process, though its customer service does not reach the same level of acclaim.

Pricing and ROI: NetWitness may involve higher setup costs but offers significant ROI owing to extensive features and comprehensive security benefits. Graylog, being moderate in price, provides a good return by enhancing log management efficiency. Users find a quicker ROI with Graylog due to its effective log processing and adaptability.

To learn more, read our detailed Graylog vs. NetWitness Platform Report (Updated: June 2025).

Buyer's Guide

Graylog vs. NetWitness Platform

June 2025

Download the complete report

Helped 860,592 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Graylog

Ranking in Log Management

15th

Average Rating

8.0

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

No ranking in other categories

NetWitness Platform

Ranking in Log Management

37th

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (29th)

Mindshare comparison

As of July 2025, in the Log Management category, the mindshare of Graylog is 6.5%, up from 5.9% compared to the previous year. The mindshare of NetWitness Platform is 0.3%, down from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Ivan Kokalovic

DevOps Engineer at Proton Technologies

Facilitates backend service monitoring with efficient log retrieval and API flexibility

Graylog is valuable because it bridges technical knowledge to non-technical teams, presenting complex backend processes in a simple timeline. It boosts the knowledge of sales and customer support teams by allowing them to see the backend operations without needing to read the code. Its API is flexible for visualization, and its powerful search engine efficiently handles large volumes of log data. Moreover, its stability, fast search capabilities, and compatibility with languages like ANSI SQL enhance its utility in IT infrastructure.

Read full review

MOTASHIM Al Razi

CISO at One Bank Limited

It is a stable solution, but they should make the user interface easier to understand

The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We're using the Community edition, but I know that it has really good dashboarding and alerts."

"It has data adapters and lookup tables that utilize HTTP calls to APIs."

"Storing logs in Elasticsearch means log retrieval is extremely fast, and full text search is available by default."

"I am very proud of how very stable the solution is."

"Real-time UDP/GELF logging and full text-based searching."

"One of the most valuable features is that you are able to do a very detailed search through the log messages in the overview."

"Allowing us to set up alerts and integrate with platforms we already use, such as Slack and OpsGenie to alert users of these errors proactively, is also a very useful feature."

"The product is scalable. The solution is stable."

More Graylog pros

"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."

"Incident management is its most valuable feature."

"The solution is really scalable for the high-end power, enterprise customer."

"The software is scalable to whatever is required, and you can also put a lot of resources in the cloud."

"The most valuable feature is the ability to write rules and triggers for network communication, and then being able to investigate based on that."

"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."

"The most valuable feature is the security that it provides."

"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"

More NetWitness Platform pros

Cons

"I would like to see a default dashboard widget that shows the topology of the clusters defined for the graylog install."

"The biggest problem is the collector application, as we wanted to avoid using Graylog Collector Sidecar due to its architecture."

"The infrastructure cost is the main issue. I like the rest. If the infrastructure costs could be lower, it would be fantastic."

"Dashboards, stream alerts and parsing could be improved."

"The area in Graylog that needs to be improved or enhanced would be the integrations."

"It would be great if Graylog could provide a better Python package in order to make it easier to use for the Python community."

"With technical support, you are on your own without an enterprise license."

"When it comes to configuring the processing pipeline, writing the rules can be very tedious, especially since the documentation isn't extensive on how the functions provided for these rules work."

More Graylog cons

"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."

"Log aggregation is an issue with this solution because there are a huge number of alerts in a single instance."

"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."

"I believe that integrating the solution with other products such as Oracle would be beneficial."

"More customizability is required, which is something that they need to improve on."

"An area for improvement would be better automation and more inbuilt use cases."

"Health monitoring of the event sources and devices."

"The initial setup is complex. There are other solutions that are easier to implement."

More NetWitness Platform cons

Pricing and Cost Advice

"I use the free version of Graylog."

"We're using the Community edition."

"It's an open-source solution that can be used free of charge."

"If you want something that works and do not have the money for Splunk or QRadar, take Graylog."

"There is an open source version and an enterprise version. I wouldn't recommend the enterprise version, but as an open source solution, it is solid and works really well."

"We are using the free version of the product. However, the paid version is expensive."

"Graylog is a free open-source solution. The free version has a capacity limitation of 2 GB daily, if you want to go above this you have to purchase a license."

"Consider Enterprise support if you have atypical needs or setup requirements."

More Graylog pricing and cost advice

"The product is expensive."

"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."

"It’s cheaper to run virtual machines in a VMware environment."

"The tool is very expensive, so I rate the pricing a ten out of ten. The solution has an annual subscription."

"Our license is for one year."

"This is a pricey solution; it's not cheap."

"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."

"The product price was reasonable for my region and the market."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

860,592 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Computer Software Company

17%

Comms Service Provider

10%

University

Educational Organization

Financial Services Firm

17%

Computer Software Company

17%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Graylog?

The product is scalable. The solution is stable.

See all answers

What is your experience regarding pricing and costs for Graylog?

I am not familiar with the pricing details of Graylog, as I was not responsible for that aspect. It was determined that we didn't need an enterprise plan, which is more suited for clients with less...

See all answers

What needs improvement with Graylog?

An improvement I would suggest is in Graylog's user interface, such as allowing for font size adjustments. A potential enhancement could be the integration with Ollama to run large language models ...

See all answers

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

See all answers

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

See all answers

Comparisons

Grafana Loki vs Graylog

Compared 36% of the time

Wazuh vs Graylog

Compared 25% of the time

syslog-ng vs Graylog

Compared 11% of the time

Security Onion vs Graylog

Compared 6% of the time

Fortinet FortiAnalyzer vs Graylog

Compared 3% of the time

More Graylog Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 23% of the time

IBM Security QRadar vs NetWitness Platform

Compared 21% of the time

Elastic Security vs NetWitness Platform

Compared 14% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 9% of the time

RSA enVision vs NetWitness Platform

Compared 9% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

Graylog

June 2025

Download Graylog product report

Buyer's Guide

NetWitness Platform

June 2025

Download NetWitness Platform product report

Also Known As

Graylog2

RSA Security Analytics

Overview

Graylog is purpose-built to deliver the best log collection, storage, enrichment, and analysis. Graylog is:

Considerably faster analysis speeds.
More robust and easier-to-use analysis platform.
Simpler administration and infrastructure management.
Lower cost than alternatives.
Full-scale customer service.
No expensive training or tool experts required.

Graylog

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Sample Customers

Blue Cross Blue Shield, eBay, Cisco, LinkedIn, SAP, King.com, Twilio, Deutsche Presse-Agentur

Los Angeles World Airports, Reply

Buyer's Guide

Graylog vs. NetWitness Platform

June 2025

Free Report: Graylog vs. NetWitness Platform

Find out what your peers are saying about Graylog vs. NetWitness Platform and other solutions. Updated: June 2025.

DOWNLOAD NOW

860,592 professionals have used our research since 2012.

See our Graylog vs. NetWitness Platform report.

See our list of best Log Management vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.