IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

IBM and NetWitness are both solutions in the Log Management category. IBM is ranked #46 with an average rating of 7.5, while NetWitness is ranked #35 with an average rating of 8.0. IBM holds a 0.4% mindshare in Log Management, compared to NetWitness’s 0.4% mindshare. Additionally, 96% of IBM users are willing to recommend the solution, compared to 75% of NetWitness users who would recommend it.

IBM SevOne Network Performa...

Read 54 IBM SevOne Network Performance Management (NPM) reviews

3,214 Views
707 Comparison Views

96% willing to recommend

NetWitness Platform

Read 37 NetWitness Platform reviews

1,469 Views
690 Comparison Views

75% willing to recommend

IBM SevOne Network Performa...

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 9, 2024

NetWitness Platform and IBM SevOne Network Performance Management compete in network security and performance management. IBM SevOne NPM is preferred for its robust capabilities despite higher costs, while NetWitness is favored for pricing and support.

Features: NetWitness Platform offers strong threat detection, advanced analytics, and competitive pricing. IBM SevOne NPM provides comprehensive monitoring, detailed reporting, and a wide range of performance metrics.

Room for Improvement: NetWitness Platform requires enhancements in integration, performance speed, and ease of use. IBM SevOne NPM needs improvements in scalability, operational intuitiveness, and potentially a more responsive customer service.

Ease of Deployment and Customer Service: NetWitness Platform faces challenges in deployment with a steep learning curve but receives positive customer service feedback. IBM SevOne NPM offers a smoother deployment process but has varied customer service reviews.

Pricing and ROI: NetWitness Platform's competitive pricing leads to satisfaction in setup costs and solid ROI in threat management. IBM SevOne NPM, although initially more costly, is seen as worth the investment due to detailed insights, leading to perceived high ROI.

To learn more, read our detailed IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform Report (Updated: July 2025).

Buyer's Guide

IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform

July 2025

Download the complete report

Helped 865,384 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

IBM SevOne Network Performa...

Ranking in Log Management

46th

Average Rating

8.4

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

Network Monitoring Software (47th), Server Monitoring (20th), IT Infrastructure Monitoring (46th), Cloud Monitoring Software (30th)

NetWitness Platform

Ranking in Log Management

35th

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (31st)

Mindshare comparison

As of August 2025, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 0.4%, up from 0.3% compared to the previous year. The mindshare of NetWitness Platform is 0.4%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Grzegorz Nowak

Solution Architect at Wingu

Improves infrastructure planning by helping us analyze network traffic

We use SevOne to collect and report on network flows SevOne improves infrastructure planning by helping us analyze network traffic. We can look at bandwidth for specific endpoints on the customer's network and analyze traffic to identify issues. For example, maybe some connectors are unavailable.…

Read full review

MOTASHIM Al Razi

CISO at One Bank Limited

It is a stable solution, but they should make the user interface easier to understand

The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It also gives us the closest thing to real-time insight into network performance that we have, with just a 10-second delay. It's very important for us to know the health of the infrastructure very quickly."

"The SMP and the xStats, which is for flat file integration, are both useful for integrating the various metrics that the device provides to monitor the performance of those systems."

"The feature that I have found most valuable is the scale-up and scale-down. The scale-up is an operation where the CPU boosts-up and then the memory will boost-up. That works awesomely."

"The comprehensiveness of this solution's collection of network performance and flow data is one of the basics in the field for what it does. It meets all of our needs. So for all those areas, for the most straightforward collection capabilities, right up to NetFlow and even telemetry, it meets all those demands. Not only just basic or fundamental SNMP collection capability, but the product also supports what we need for the future with telemetry streaming. So it's very comprehensive."

"One of the solution's biggest strengths is its capacity management performance, with out-of-the-box reports through NMS, as well as its ability to collect NetFlow-related data from devices. The collection of network performance and flow data is important because we have many critical business applications."

"The most valuable feature as of late has been the API integration with ServiceNow."

"We find that the reporting is particularly valuable in terms of not only communicating with our peer teams but also with the executives."

"We have benefited mainly from the use of the dashboard interface. It makes the network visually interesting for other people who are not in the network. A lot of people are not network techies who understand streams in the network. Based on location, we have streams coming in and out. They can see visually when there is some problem. They don't need to understand all the network technology behind it to be able to understand if everything is working well or if there is a problem."

More IBM SevOne Network Performance Management (NPM) pros

"It gives the capability for the incident response team to correlate logs to identify any kind of problem like malware and incidents in a general sense, both for logs and packets."

"The most valuable feature is the hunting ability to work in a CERT."

"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."

"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"

"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."

"Their technical support responds quickly and are knowledgable."

"Offers a good wireless feature."

"The product has a user-friendly interface and a valuable feature for threat intelligence integration."

More NetWitness Platform pros

Cons

"Some similar solutions offer end-to-end visibility."

"SevOne should work with the graphs legend functionality."

"With the administrative management of the appliance, if some object appears from SevOne because something changed in the network or whatever, then as an administrator you will not be aware. If you are using this object in a report, this object will disappear from the report and you will not be aware of it. So, if you have 1,000 reports, you cannot always check these reports everyday to see if objects are missing or information has disappeared. We don't have any information on alerts, saying that something is happening there and maybe we need to take action. If an object was replaced by another one, or if a link was replaced by another one, then the graph needs to be changed because it doesn't exist in the graph anymore. However, we don't have this information."

"The reports are easy to configure but they are a bit outdated in terms of appearance and visualization."

"In terms of having a complete view of our network performance, I would rate it a nine out of 10. The reason for not giving it a 10 is that there is no packet capture associated with SevOne, but we do have other tools in place to do that."

"You need to plan integrations. That has been the biggest bug with SevOne so far. For the things that SevOne pulls directly, those are easy to understand, modify, and put into the database. For things that need to use the Universal Collector or xStats, you need to plan that stuff well in advance."

"Their virtualization solution is not compatible with our Kubernetes environment, which is one of the reasons we are ending our relationship with them."

"We need to be thinking about streaming telemetry protocols. They already have the port for enhanced visualization, which they already have through Data Insight."

More IBM SevOne Network Performance Management (NPM) cons

"Log aggregation is an issue with this solution because there are a huge number of alerts in a single instance."

"We have encountered issues with unresolved crashes."

"There is no support for this product in this country, so problems have to be resolved through global technical teams."

"The system looks like it is a mix of a bunch of different systems, and nothing looked like it was quite together."

"Technical support could be improved."

"The initial setup is complex. There are other solutions that are easier to implement."

"The user interface is a little bit difficult for new users and it needs to be improved."

"There are instances where you try to run the reports and then it does not give you the desired outcome."

More NetWitness Platform cons

Pricing and Cost Advice

"A blocking point is the high upfront cost because it is challenging to get it accepted and the purchase approved."

"Many tools price things based on the number of KPIs that you're collecting around a device. In many cases, there could be hundreds of metrics that you need to collect. SevOne provides device-level pricing. That gives us the flexibility to turn on, and expand on, the metrics that we're collecting around those devices, without taking a financial hit."

"There are cheaper solutions available."

"For the value that you get from SevOne, it's worth the price. There are a lot of cheaper alternatives on the market, and even free options. But they require more staff, more resources, and engineers with more advanced knowledge of monitoring. That's what makes SevOne worth the price."

"There are different options available for licensing, with the per-device option being more expensive but more flexible."

"Choose a SevOne partner who can provide SevOne as a service and can deliver professional services and maintenance."

"The tool is not expensive. We were able to negotiate with SevOne on pricing."

"Although I don't have exact details in terms of cost, my experience has been that SevOne is willing to make a deal with the customer."

More IBM SevOne Network Performance Management (NPM) pricing and cost advice

"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."

"We are on an annual license for the use of the solution."

"It’s cheaper to run virtual machines in a VMware environment."

"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."

"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."

"The product is expensive."

"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."

"The product price was reasonable for my region and the market."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

865,384 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Manufacturing Company

14%

Financial Services Firm

14%

Computer Software Company

11%

Legal Firm

Financial Services Firm

14%

Computer Software Company

13%

Comms Service Provider

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What needs improvement with SevOne Network Data Platform?

There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...

See all answers

What is your primary use case for SevOne Network Data Platform?

The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...

See all answers

What advice do you have for others considering SevOne Network Data Platform?

To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...

See all answers

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

See all answers

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

See all answers

Comparisons

Instana Infrastructure Monitoring vs IBM SevOne Network Performance Management (NPM)

Compared 8% of the time

Zabbix vs IBM SevOne Network Performance Management (NPM)

Compared 8% of the time

Splunk Enterprise Security vs IBM SevOne Network Performance Management (NPM)

Compared 8% of the time

SolarWinds Network Device Monitor vs IBM SevOne Network Performance Management (NPM)

Compared 6% of the time

NETSCOUT nGeniusONE vs IBM SevOne Network Performance Management (NPM)

Compared 6% of the time

More IBM SevOne Network Performance Management (NPM) Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 23% of the time

IBM Security QRadar vs NetWitness Platform

Compared 19% of the time

Elastic Security vs NetWitness Platform

Compared 12% of the time

RSA enVision vs NetWitness Platform

Compared 9% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 9% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

IBM SevOne Network Performance Management (NPM)

August 2025

IBM SevOne Network Performance Management (NPM) report

Download IBM SevOne Network Performance Management (NPM) product report

Buyer's Guide

NetWitness Platform

August 2025

Download NetWitness Platform product report

Also Known As

SevOne

RSA Security Analytics

Overview

The IBM® SevOne Network Performance Management (IBM SevOne NPM) solution helps you spot, address, and prevent network performance issues early with machine learning-powered analytics from a single source. Boost network performance and improve your user application experience by proactively monitoring your multivendor end-to-end network across enterprise, communication, and managed service provider networks.

Transform raw network performance data into intelligent and actionable insights. The IBM SevOne NPM solution goes beyond detection, combining industry-leading expertise and advanced technology to help your IT team plan and optimize your network and act on what matters: improving network performance to provide an exceptional customer experience.

For further information, please visit www.ibm.com/cloud/sevo...

IBM

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)

Los Angeles World Airports, Reply

Buyer's Guide

IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform

July 2025

Free Report: IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform

Find out what your peers are saying about IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform and other solutions. Updated: July 2025.

DOWNLOAD NOW

865,384 professionals have used our research since 2012.

See our IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform report.

See our list of best Log Management vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.