IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform

Download the complete report

Helped 850,028 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

IBM SevOne Network Performa...

Ranking in Log Management

44th

Average Rating

8.4

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

Network Monitoring Software (37th), Server Monitoring (18th), IT Infrastructure Monitoring (43rd), Cloud Monitoring Software (29th)

NetWitness Platform

Ranking in Log Management

22nd

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (22nd)

Mindshare comparison

As of May 2025, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 0.3%, up from 0.3% compared to the previous year. The mindshare of NetWitness Platform is 0.3%, down from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Grzegorz Nowak

Solution Architect at Wingu

Improves infrastructure planning by helping us analyze network traffic

We use SevOne to collect and report on network flows SevOne improves infrastructure planning by helping us analyze network traffic. We can look at bandwidth for specific endpoints on the customer's network and analyze traffic to identify issues. For example, maybe some connectors are unavailable.…

Read full review

MdZaman

IT manager at a agriculture with 10,001+ employees

Really scalable for enterprise customers

The solution should have more integration capabilities with different platforms. The API is nearly open and scalable, so the solution can integrate with many platforms. The solution has more than 200 log sources in the scalability to support, but this is its limit. Installation is pretty easy. However, there are a couple of modules involved, so it is not as easy as it could be. We are talking about a distributed module, not a single-module type. This is what makes things a bit complex, instead of easier. I rate it as a seven out of ten on its installation and configuration capabilities.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The out of the box reports and workflows are pretty good and they meet our requirements well."

"It also gives us the closest thing to real-time insight into network performance that we have, with just a 10-second delay. It's very important for us to know the health of the infrastructure very quickly."

"The monitoring of the network is very customizable. That is its unique feature."

"One of the most valuable features is the graphs, which you can build instantly. I have used some open-source platforms in the past, but they are not as good. With SevOne, the sampling in the graph can be every few seconds, not just every few minutes, and that's really helpful. It's really fast."

"It's given us the ability to create various real-time network performance reports and distribute them to any colleague who can access these reports immediately."

"We have benefited mainly from the use of the dashboard interface. It makes the network visually interesting for other people who are not in the network. A lot of people are not network techies who understand streams in the network. Based on location, we have streams coming in and out. They can see visually when there is some problem. They don't need to understand all the network technology behind it to be able to understand if everything is working well or if there is a problem."

"The network data collection has been very flexible for us. It's been thorough in areas that were lacking. They have a team that I've worked with to add other pieces to it. So if it's missing something out of the box, they work with me to add it. I was able to collect that data. It's not perfect, but it's pretty thorough."

"Data Insight reporting tool is the most valuable feature. They came up with it a couple of years ago. The most pleasing factor is the dark theme. You don't have a white background. It has templates that you can create for all kinds of reports that you can hit on the fly. It's much better printing of the reports. If you want to send PDFs to people, the reports are actually decent. Whereas for years, the old architecture of the PDFs was rubbish and even our customers said, "We have to manipulate your PDFs because they all have bad margin breaks. SevOne fixed that a couple of years ago with the new Data Insight. It's fantastic."

More IBM SevOne Network Performance Management (NPM) pros

"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"

"NetWitness Platform offers flexibility for deployment and robust integration capabilities."

"The newer 11.5 version that my team is using has found it to have good mapping."

"The most valuable feature is the ability to write rules and triggers for network communication, and then being able to investigate based on that."

"NetWitness Platform is valuable for creating rules that the solution must detect."

"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."

"The most valuable features are the packet decoder, log decoder, and concentrator."

"Incident management is its most valuable feature."

More NetWitness Platform pros

Cons

"I'm not really sure if this was the software's fault or a server issue, but a couple of years back the disks were failing on our SevOne physical server every month and the server would go down. The secondary server took over from the primary until the disk issue was resolved. That was annoying."

"You need to plan integrations. That has been the biggest bug with SevOne so far. For the things that SevOne pulls directly, those are easy to understand, modify, and put into the database. For things that need to use the Universal Collector or xStats, you need to plan that stuff well in advance."

"Would benefit with the addition of AI modules for proactive data insights."

"There are some tweaks and enhancements that I've already requested. One is to be able to make changes per device rather than as a global setting. That has to do with naming. It's minor."

"Telemetry is hot these days, and IBM can improve SevOne's support for telemetry correction. Reporting is another feature that could be better. It provides the bare minimum functionality, which is good enough for most engineers, but the management isn't advanced. The new portal provides a much lighter view and better visualization, but the management is not so good."

"Their virtualization solution is not compatible with our Kubernetes environment, which is one of the reasons we are ending our relationship with them."

"The GUI: both the dashboard/user view and the admin tool."

"One area that requires a little bit of improvement is the topology of visualization and being able to map out connections, end-to-end. It's able to do that, but it's not as impressive as we would like it to be. We would like to understand the different interface types and the connection points better, through the visualization. Heatmaps also need further development."

More IBM SevOne Network Performance Management (NPM) cons

"Sometimes, it gives me static when integrating Windows-based systems. It should produce a precise log of sorts as to where the problem is. For example, a few days ago because of the McAfee application firewall, I couldn't get access to the particular Windows machine. So, my team and I had to figure out by ourselves that there was a virus responsible for the obstacle. This solution should trigger a meaningful log or message indicating the reason the user or implementer can't get into the machine."

"More customizability is required, which is something that they need to improve on."

"The multi-tenant capabilities are lagging compared to IBM QRadar."

"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."

"It is not so easy to customize this product."

"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."

"The log system is a bit complex and has room for improvement."

"They should implement algorithms to digest that data and produce additional, more advanced reporting, alerting and support of internal security teams."

More NetWitness Platform cons

Pricing and Cost Advice

"Many tools price things based on the number of KPIs that you're collecting around a device. In many cases, there could be hundreds of metrics that you need to collect. SevOne provides device-level pricing. That gives us the flexibility to turn on, and expand on, the metrics that we're collecting around those devices, without taking a financial hit."

"The pricing has been fair."

"It is inexpensive compared to other monitoring tools."

"Choose a SevOne partner who can provide SevOne as a service and can deliver professional services and maintenance."

"A blocking point is the high upfront cost because it is challenging to get it accepted and the purchase approved."

"Have a bank of licenses, because it is about the number of objects (RAM, ports, CPU, etc.)."

"The pricing has not evolved with the market, which is one of the reasons we are moving to a new product."

"For the value that you get from SevOne, it's worth the price. There are a lot of cheaper alternatives on the market, and even free options. But they require more staff, more resources, and engineers with more advanced knowledge of monitoring. That's what makes SevOne worth the price."

More IBM SevOne Network Performance Management (NPM) pricing and cost advice

"The product price was reasonable for my region and the market."

"The licenses are good but the cost is very expensive."

"It is cheap."

"This is a pricey solution; it's not cheap."

"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."

"Compared to the competition, the is price is not that high."

"Our license is for one year."

"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

850,028 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Manufacturing Company

14%

Computer Software Company

14%

Legal Firm

Computer Software Company

19%

Financial Services Firm

18%

Government

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What needs improvement with SevOne Network Data Platform?

There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...

What is your primary use case for SevOne Network Data Platform?

The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...

What advice do you have for others considering SevOne Network Data Platform?

To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

Instana Infrastructure Monitoring vs IBM SevOne Network Performance Management (NPM)

Comparisons

Compared 11% of the time

NETSCOUT nGeniusONE vs IBM SevOne Network Performance Management (NPM)

Compared 10% of the time

SolarWinds Network Device Monitor vs IBM SevOne Network Performance Management (NPM)

Compared 10% of the time

Splunk Enterprise Security vs IBM SevOne Network Performance Management (NPM)

Compared 9% of the time

Zabbix vs IBM SevOne Network Performance Management (NPM)

Compared 8% of the time

More IBM SevOne Network Performance Management (NPM) Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 28% of the time

IBM Security QRadar vs NetWitness Platform

Compared 18% of the time

Elastic Security vs NetWitness Platform

Compared 14% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 11% of the time

RSA enVision vs NetWitness Platform

Compared 10% of the time

More NetWitness Platform Competitors

Product Reports

IBM SevOne Network Performance Management (NPM)

Download IBM SevOne Network Performance Management (NPM) product report

IBM SevOne Network Performance Management (NPM) report

NetWitness Platform

Download NetWitness Platform product report

Also Known As

SevOne

RSA Security Analytics

Overview

The IBM® SevOne Network Performance Management (IBM SevOne NPM) solution helps you spot, address, and prevent network performance issues early with machine learning-powered analytics from a single source. Boost network performance and improve your user application experience by proactively monitoring your multivendor end-to-end network across enterprise, communication, and managed service provider networks.

Transform raw network performance data into intelligent and actionable insights. The IBM SevOne NPM solution goes beyond detection, combining industry-leading expertise and advanced technology to help your IT team plan and optimize your network and act on what matters: improving network performance to provide an exceptional customer experience.

For further information, please visit www.ibm.com/cloud/sevo...

IBM

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)

Los Angeles World Airports, Reply

IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform