No more typing reviews! Try our Samantha, our new voice AI agent.

IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

IBM SevOne Network Performa...
Ranking in Log Management
37th
Average Rating
8.4
Reviews Sentiment
7.2
Number of Reviews
54
Ranking in other categories
Network Monitoring Software (34th), Server Monitoring (17th), IT Infrastructure Monitoring (35th), Cloud Monitoring Software (27th)
NetWitness Platform
Ranking in Log Management
38th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Security Information and Event Management (SIEM) (36th)
 

Mindshare comparison

As of July 2026, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 1.1%, up from 0.4% compared to the previous year. The mindshare of NetWitness Platform is 1.1%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
IBM SevOne Network Performance Management (NPM)1.1%
NetWitness Platform1.1%
Other97.8%
Log Management
 

Featured Reviews

reviewer1543041 - PeerSpot reviewer
Network monitoring engineer at a tech vendor with 10,001+ employees
Provides consistent infrastructure monitoring with excellent usability and support
The primary use case of IBM SevOne Network Performance Management (NPM) is network monitoring. It helps to maintain the infrastructure's availability and ensure that alerts are generated when needed The most valuable features of IBM SevOne Network Performance Management (NPM) are its stability,…
reviewer2256927 - PeerSpot reviewer
Head of Information Security, Cyber Defense and IT Risk Management at HCT. at a transportation company with 201-500 employees
A solid SIEM solution that should improve technical support and online resources to be easier to use
A big problem with the product is that we don't have much professional experience in Israel installing, implementing, and integrating this product. There is not enough of a knowledge base. There is no support for this product in this country, so problems have to be resolved through global technical teams. We like to work locally because of the language, and when the product is only supported outside the country, it's a little difficult to implement and use this product. Moreover, AI is something that must be added immediately. Artificial intelligence is a part of the competitors' products, and it's not been implemented for us.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"SevOne has improved my organization by taking us to a single pane of glass for alerting on the network reports."
"SevOne is excellent for transforming raw network performance data into actionable insights."
"The monitoring of the network is very customizable. That is its unique feature."
"SevOne provides support for all universal connectors. They internally work with other data sources to get features implemented. We have an SD-WAN implementation and use other app data to monitor performance. If you pull that data into one centralized location, that is very useful for management."
"SevOne enables us to look at the data and see that the customer has disconnected so we can stop billing and reimbursing them."
"Scalability. I have never had to worry about how to handle really big environments."
"The network data collection has been very flexible for us. It's been thorough in areas that were lacking. They have a team that I've worked with to add other pieces to it. So if it's missing something out of the box, they work with me to add it. I was able to collect that data. It's not perfect, but it's pretty thorough."
"We have benefited mainly from the use of the dashboard interface. It makes the network visually interesting for other people who are not in the network. A lot of people are not network techies who understand streams in the network. Based on location, we have streams coming in and out. They can see visually when there is some problem. They don't need to understand all the network technology behind it to be able to understand if everything is working well or if there is a problem."
"It gives the capability for the incident response team to correlate logs to identify any kind of problem like malware and incidents in a general sense, both for logs and packets."
"The product's initial setup phase was not at all difficult."
"Integration is exceedingly minimal, since its project development is much easier than that of LogRythm or IBM."
"The most valuable features are the threat prediction and network forensics."
"Since the solution has been under way we have seen a large decrease of threats and proactive reactions to incidents."
"NetWitness can be highly beneficial for incident detection and response."
"Overall, this is a good solution with suitable features and it very well fits our needs."
"The most valuable feature is the correlation, as it can report in real-time and monitor the management."
 

Cons

"User-friendly, multi-tenancy."
"Although it is a very good monitoring tool, it can be confusing when you try to add devices and they don’t appear correctly."
"Some similar solutions offer end-to-end visibility."
"When I started using it, I tried adding one of the BroadWorks application servers into SevOne... it created thousands and thousands of objects from that one application server and we immediately ran out of license... It would help, when new objects are discovered, if there were a way to categorize those objects and to pick the part of the object you need..."
"There are a lot of pain points. My main problem is that we don't have a high availability system."
"Some of the services and functionality are adapted for SevOne via open-source, and the cost is very high. For the price that they are asking, it cannot be justified."
"This product needs a lot of handholding and close collaboration with network design resources, in terms of choosing the appliance and the number of licenses."
"In the area of server monitoring, it has some areas for improvement."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"The initial setup is complex. It requires some knowledge in order to set it up."
"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."
"The initial setup was complex because it takes a lot of time to complete the implementation."
"Nowadays, their support is a little subpar compared to other solutions. I rate RSA support six out of 10."
"We encountered stability issues in the earlier versions, and much fewer in the newer versions."
"We have encountered issues with unresolved crashes."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
 

Pricing and Cost Advice

"There are different options available for licensing, with the per-device option being more expensive but more flexible."
"Prices per license are not huge, but they exist."
"The tool is not expensive. We were able to negotiate with SevOne on pricing."
"A blocking point is the high upfront cost because it is challenging to get it accepted and the purchase approved."
"The pricing has been fair."
"Although I don't have exact details in terms of cost, my experience has been that SevOne is willing to make a deal with the customer."
"There are cheaper solutions available."
"It is inexpensive compared to other monitoring tools."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
"The product is expensive."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"This is a pricey solution; it's not cheap."
"It is cheap."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"The licenses are good but the cost is very expensive."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
902,894 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Construction Company
12%
Manufacturing Company
11%
Comms Service Provider
7%
Financial Services Firm
12%
Construction Company
11%
Comms Service Provider
9%
Outsourcing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise6
Large Enterprise45
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What needs improvement with SevOne Network Data Platform?
There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...
What is your primary use case for SevOne Network Data Platform?
The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...
What advice do you have for others considering SevOne Network Data Platform?
To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

SevOne
RSA Security Analytics
 

Overview

 

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)
Los Angeles World Airports, Reply
Find out what your peers are saying about IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform and other solutions. Updated: June 2026.
902,894 professionals have used our research since 2012.