No more typing reviews! Try our Samantha, our new voice AI agent.

IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

IBM SevOne Network Performa...
Ranking in Log Management
35th
Average Rating
8.4
Reviews Sentiment
7.2
Number of Reviews
54
Ranking in other categories
Network Monitoring Software (29th), Server Monitoring (15th), IT Infrastructure Monitoring (35th), Cloud Monitoring Software (28th)
NetWitness Platform
Ranking in Log Management
36th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Security Information and Event Management (SIEM) (35th)
 

Mindshare comparison

As of October 2026, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 1.1%, up from 0.4% compared to the previous year. The mindshare of NetWitness Platform is 1.2%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
IBM SevOne Network Performance Management (NPM)1.1%
NetWitness Platform1.2%
Other97.7%
Log Management
 

Featured Reviews

reviewer1543041 - PeerSpot reviewer
Network monitoring engineer at a tech vendor with 10,001+ employees
Provides consistent infrastructure monitoring with excellent usability and support
The primary use case of IBM SevOne Network Performance Management (NPM) is network monitoring. It helps to maintain the infrastructure's availability and ensure that alerts are generated when needed The most valuable features of IBM SevOne Network Performance Management (NPM) are its stability,…
reviewer1130436 - PeerSpot reviewer
Information Technology Security and Infrastructure Expert at a government with 201-500 employees
Helps to deal with potential attacks and is available at a reasonable price
My company has had many benefits from the use of the product in the last eight years. The tool has streamlined our company's incident response process since it serves as a log repository, which allows us to correlate events and access different technology stacks. In our company, we were able to actually find some potential attacks, so it has been very helpful. The tool's integration capability isn't so great. In my company, we managed to integrate it with our Microsoft Azure Subscription, after which we managed to integrate it with other tools. You will face a lot of difficulties if you want to integrate it with your database monitoring tool, PAM solutions, or IAM products. The product has done well overall for my company's teams to deal with their workflow efficiency. I would not recommend the product to others. I rate the tool a seven out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Flexible architecture: You can extend the system and its capacity by attaching another cluster pair."
"Fantastic – for money laid out vs. what you’re getting back, it's been great."
"It's a great solution for highlighting and discovering useful information regarding our network's elements."
"The monitoring of the network is very customizable. That is its unique feature."
"The most valuable feature as of late has been the API integration with ServiceNow."
"It is a very good product, easy to stand up, and a good tool for network engineers."
"The comprehensiveness of this solution's collection of network performance and flow data is one of the basics in the field for what it does. It meets all of our needs. So for all those areas, for the most straightforward collection capabilities, right up to NetFlow and even telemetry, it meets all those demands. Not only just basic or fundamental SNMP collection capability, but the product also supports what we need for the future with telemetry streaming. So it's very comprehensive."
"SevOne has rich API capabilities, giving us the flexibility to control what we collect and customize the collection, creation, and manipulation of now metrics as necessary."
"NetWitness can be highly beneficial for incident detection and response."
"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."
"Thanks to this tool, we have a small SOC running in our company."
"Overall, this is a good solution with suitable features and it very well fits our needs."
"The most valuable features are the packet decoder, log decoder, and concentrator."
"Incident management is its most valuable feature."
"Over time, NetWitness Logs and Packets has matured from a boxed solution with multiple parts to the current, more streamlined version for which we only need the software license to put it up on our own cloud and deliver it to multiple clients."
"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."
 

Cons

"Enhanced baselining capability would be an improvement."
"On a scale of one to ten, I am neutral because it is not too good and not too bad."
"User-friendly, multi-tenancy."
"Continual UI improvements are needed to reduce number of clicks needed to produce a chart."
"With the administrative management of the appliance, if some object appears from SevOne because something changed in the network or whatever, then as an administrator you will not be aware."
"The only thing that worries me with SevOne is that they were acquired by Turbonomic and now by IBM."
"When I started using it, I tried adding one of the BroadWorks application servers into SevOne... it created thousands and thousands of objects from that one application server and we immediately ran out of license... It would help, when new objects are discovered, if there were a way to categorize those objects and to pick the part of the object you need..."
"With the administrative management of the appliance, if some object appears from SevOne because something changed in the network or whatever, then as an administrator you will not be aware. If you are using this object in a report, this object will disappear from the report and you will not be aware of it. So, if you have 1,000 reports, you cannot always check these reports everyday to see if objects are missing or information has disappeared. We don't have any information on alerts, saying that something is happening there and maybe we need to take action. If an object was replaced by another one, or if a link was replaced by another one, then the graph needs to be changed because it doesn't exist in the graph anymore. However, we don't have this information."
"RSA NetWitness Logs and Packets is far behind the competition."
"I believe they could improve their support, there are often delays."
"The documentation is not as structured as I would like, personally, and I think that it can be improved and made much more user-friendly."
"Sometimes, it gives me static when integrating Windows-based systems. It should produce a precise log of sorts as to where the problem is. For example, a few days ago because of the McAfee application firewall, I couldn't get access to the particular Windows machine. So, my team and I had to figure out by ourselves that there was a virus responsible for the obstacle. This solution should trigger a meaningful log or message indicating the reason the user or implementer can't get into the machine."
"Security needs improvement."
"But the 11.3 version is a complete disaster. You cannot analyze anything."
"I cannot say that the solution was stable because it tended to crash."
"Cross Platform Integration could be improved."
 

Pricing and Cost Advice

"A blocking point is the high upfront cost because it is challenging to get it accepted and the purchase approved."
"The pricing has not evolved with the market, which is one of the reasons we are moving to a new product."
"For the value that you get from SevOne, it's worth the price. There are a lot of cheaper alternatives on the market, and even free options. But they require more staff, more resources, and engineers with more advanced knowledge of monitoring. That's what makes SevOne worth the price."
"The tool is not expensive. We were able to negotiate with SevOne on pricing."
"There are cheaper solutions available."
"The pricing has been fair."
"Although I don't have exact details in terms of cost, my experience has been that SevOne is willing to make a deal with the customer."
"Prices per license are not huge, but they exist."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"Our license is for one year."
"It’s cheaper to run virtual machines in a VMware environment."
"This is a pricey solution; it's not cheap."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"The product price was reasonable for my region and the market."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
915,341 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Construction Company
12%
Manufacturing Company
12%
Financial Services Firm
12%
Outsourcing Company
9%
Construction Company
12%
Financial Services Firm
11%
Comms Service Provider
10%
Outsourcing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise6
Large Enterprise45
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What needs improvement with SevOne Network Data Platform?
There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...
What is your primary use case for SevOne Network Data Platform?
The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...
What advice do you have for others considering SevOne Network Data Platform?
To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

SevOne
RSA Security Analytics
 

Overview

 

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)
Los Angeles World Airports, Reply
Find out what your peers are saying about IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform and other solutions. Updated: September 2026.
915,341 professionals have used our research since 2012.