Try our new research platform with insights from 80,000+ expert users

IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

IBM SevOne Network Performa...
Ranking in Log Management
44th
Average Rating
8.4
Reviews Sentiment
7.2
Number of Reviews
54
Ranking in other categories
Network Monitoring Software (42nd), Server Monitoring (19th), IT Infrastructure Monitoring (40th), Cloud Monitoring Software (30th)
NetWitness Platform
Ranking in Log Management
34th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Security Information and Event Management (SIEM) (31st)
 

Mindshare comparison

As of January 2026, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 0.6%, up from 0.3% compared to the previous year. The mindshare of NetWitness Platform is 0.6%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Market Share Distribution
ProductMarket Share (%)
NetWitness Platform0.6%
IBM SevOne Network Performance Management (NPM)0.6%
Other98.8%
Log Management
 

Featured Reviews

reviewer1543041 - PeerSpot reviewer
Network monitoring engineer at a tech vendor with 10,001+ employees
Provides consistent infrastructure monitoring with excellent usability and support
The primary use case of IBM SevOne Network Performance Management (NPM) is network monitoring. It helps to maintain the infrastructure's availability and ensure that alerts are generated when needed The most valuable features of IBM SevOne Network Performance Management (NPM) are its stability,…
MOTASHIM Al Razi - PeerSpot reviewer
CISO at One Bank Limited
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It's a great solution for highlighting and discovering useful information regarding our network's elements."
"It also gives us the closest thing to real-time insight into network performance that we have, with just a 10-second delay. It's very important for us to know the health of the infrastructure very quickly."
"The automation feature is good because if your CMDB is OK and it is already in sync, then the automation part is good to go."
"The SMP and the xStats, which is for flat file integration, are both useful for integrating the various metrics that the device provides to monitor the performance of those systems."
"The most valuable feature as of late has been the API integration with ServiceNow."
"One of the most valuable features is the graphs, which you can build instantly. I have used some open-source platforms in the past, but they are not as good. With SevOne, the sampling in the graph can be every few seconds, not just every few minutes, and that's really helpful. It's really fast."
"Another useful feature is that SevOne gives you real-time insights into your network performance. It polls every five minutes. That is important for our customers because there are some network teams that are always monitoring their networks."
"The monitoring of the network is very customizable. That is its unique feature."
"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."
"NetWitness Platform is valuable for creating rules that the solution must detect."
"Incident management is its most valuable feature."
"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"
"The most valuable features are the packet inspection and the automated incident response."
"It's quite economical compared to other solutions in the market."
 

Cons

"I'm not really sure if this was the software's fault or a server issue, but a couple of years back the disks were failing on our SevOne physical server every month and the server would go down. The secondary server took over from the primary until the disk issue was resolved. That was annoying."
"The customizations are very hard. The person doing it has to be very good at analytics and has to be very good in all languages"
"Would benefit with the addition of AI modules for proactive data insights."
"There is no service mode setup in this monitoring tool if you want to snooze alerts for any specific amount of time, to account for any activity change or major incident."
"The method of searching for SIP and the way to create the groups."
"With the administrative management of the appliance, if some object appears from SevOne because something changed in the network or whatever, then as an administrator you will not be aware. If you are using this object in a report, this object will disappear from the report and you will not be aware of it. So, if you have 1,000 reports, you cannot always check these reports everyday to see if objects are missing or information has disappeared. We don't have any information on alerts, saying that something is happening there and maybe we need to take action. If an object was replaced by another one, or if a link was replaced by another one, then the graph needs to be changed because it doesn't exist in the graph anymore. However, we don't have this information."
"Software upgrades can be tricky is not easy."
"SevOne should work with the graphs legend functionality."
"The multi-tenant capabilities are lagging compared to IBM QRadar."
"The product's licensing models are complex to understand. This particular area needs improvement."
"An area for improvement would be better automation and more inbuilt use cases."
"The tool's integration capability isn't so great."
"Security needs improvement."
"The user interface is a little bit difficult for new users and it needs to be improved."
"The initial setup was complex because it takes a lot of time to complete the implementation."
"I believe that integrating the solution with other products such as Oracle would be beneficial."
 

Pricing and Cost Advice

"Many tools price things based on the number of KPIs that you're collecting around a device. In many cases, there could be hundreds of metrics that you need to collect. SevOne provides device-level pricing. That gives us the flexibility to turn on, and expand on, the metrics that we're collecting around those devices, without taking a financial hit."
"Choose a SevOne partner who can provide SevOne as a service and can deliver professional services and maintenance."
"Prices per license are not huge, but they exist."
"For the value that you get from SevOne, it's worth the price. There are a lot of cheaper alternatives on the market, and even free options. But they require more staff, more resources, and engineers with more advanced knowledge of monitoring. That's what makes SevOne worth the price."
"It is inexpensive compared to other monitoring tools."
"Have a bank of licenses, because it is about the number of objects (RAM, ports, CPU, etc.)."
"A blocking point is the high upfront cost because it is challenging to get it accepted and the purchase approved."
"The pricing has not evolved with the market, which is one of the reasons we are moving to a new product."
"Our license is for one year."
"Compared to the competition, the is price is not that high."
"We are on an annual license for the use of the solution."
"The product is expensive."
"The product price was reasonable for my region and the market."
"The tool is very expensive, so I rate the pricing a ten out of ten. The solution has an annual subscription."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
No data available
Financial Services Firm
13%
Performing Arts
9%
Computer Software Company
8%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise6
Large Enterprise45
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What needs improvement with SevOne Network Data Platform?
There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...
What is your primary use case for SevOne Network Data Platform?
The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...
What advice do you have for others considering SevOne Network Data Platform?
To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...
What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
 

Also Known As

SevOne
RSA Security Analytics
 

Overview

 

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)
Los Angeles World Airports, Reply
Find out what your peers are saying about IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform and other solutions. Updated: December 2025.
881,082 professionals have used our research since 2012.