IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform

Download the complete report

Helped 859,129 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

IBM SevOne Network Performa...

Ranking in Log Management

48th

Average Rating

8.4

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

Network Monitoring Software (45th), Server Monitoring (19th), IT Infrastructure Monitoring (44th), Cloud Monitoring Software (30th)

NetWitness Platform

Ranking in Log Management

38th

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (29th)

Mindshare comparison

As of June 2025, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 0.4%, up from 0.3% compared to the previous year. The mindshare of NetWitness Platform is 0.3%, down from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management

Featured Reviews

Grzegorz Nowak

Solution Architect at Wingu

Improves infrastructure planning by helping us analyze network traffic

We use SevOne to collect and report on network flows SevOne improves infrastructure planning by helping us analyze network traffic. We can look at bandwidth for specific endpoints on the customer's network and analyze traffic to identify issues. For example, maybe some connectors are unavailable.…

Read full review

MOTASHIM Al Razi

CISO at One Bank Limited

It is a stable solution, but they should make the user interface easier to understand

The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"SevOne provides support for all universal connectors. They internally work with other data sources to get features implemented. We have an SD-WAN implementation and use other app data to monitor performance. If you pull that data into one centralized location, that is very useful for management."

"One of the most valuable features is the graphs, which you can build instantly. I have used some open-source platforms in the past, but they are not as good. With SevOne, the sampling in the graph can be every few seconds, not just every few minutes, and that's really helpful. It's really fast."

"The monitoring of the network is very customizable. That is its unique feature."

"We've had great feedback from our customers about SevOne support. They're willing to set up a remote session upon request. You have to go through three tiers of support with most vendors, and they ask a lot of screening questions before they will do a remote session. You need to spend a lot of time before an engineer will host a remote session to look at your problematic system."

"It also gives us the closest thing to real-time insight into network performance that we have, with just a 10-second delay. It's very important for us to know the health of the infrastructure very quickly."

"The automation feature is good because if your CMDB is OK and it is already in sync, then the automation part is good to go."

"The network data collection has been very flexible for us. It's been thorough in areas that were lacking. They have a team that I've worked with to add other pieces to it. So if it's missing something out of the box, they work with me to add it. I was able to collect that data. It's not perfect, but it's pretty thorough."

"Scalability. I have never had to worry about how to handle really big environments."

More IBM SevOne Network Performance Management (NPM) pros

"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."

"In my opinion, the solution's most valuable feature is its capacity to monitor network traffic, logs from devices within the network, and network captures. This capability extends beyond logs to include full network capturing."

"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."

"The most valuable features are its ingestion of logs and raising of alerts based on those logs."

"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."

"NetWitness Platform is valuable for creating rules that the solution must detect."

"The product's initial setup phase was not at all difficult."

"The newer 11.5 version that my team is using has found it to have good mapping."

More NetWitness Platform pros

Cons

"The reports are easy to configure but they are a bit outdated in terms of appearance and visualization."

"The customizations are very hard. The person doing it has to be very good at analytics and has to be very good in all languages"

"When I started using it, I tried adding one of the BroadWorks application servers into SevOne... it created thousands and thousands of objects from that one application server and we immediately ran out of license... It would help, when new objects are discovered, if there were a way to categorize those objects and to pick the part of the object you need..."

"In terms of having a complete view of our network performance, I would rate it a nine out of 10. The reason for not giving it a 10 is that there is no packet capture associated with SevOne, but we do have other tools in place to do that."

"I would like to see live maps as an added feature. Also, build modules on AI and EML to provide better data insights that would proactively tell us what we should be looking after."

"SevOne should work with the graphs legend functionality."

"With the administrative management of the appliance, if some object appears from SevOne because something changed in the network or whatever, then as an administrator you will not be aware. If you are using this object in a report, this object will disappear from the report and you will not be aware of it. So, if you have 1,000 reports, you cannot always check these reports everyday to see if objects are missing or information has disappeared. We don't have any information on alerts, saying that something is happening there and maybe we need to take action. If an object was replaced by another one, or if a link was replaced by another one, then the graph needs to be changed because it doesn't exist in the graph anymore. However, we don't have this information."

"Their virtualization solution is not compatible with our Kubernetes environment, which is one of the reasons we are ending our relationship with them."

More IBM SevOne Network Performance Management (NPM) cons

"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."

"Technical support could be improved."

"There is no support for this product in this country, so problems have to be resolved through global technical teams."

"The initial setup was complex because it takes a lot of time to complete the implementation."

"The documentation is not as structured as I would like, personally, and I think that it can be improved and made much more user-friendly."

"The initial setup is very complex and should be simplified."

"The solution should have more integration capabilities with different platforms."

"The implementation needs assistance."

More NetWitness Platform cons

Pricing and Cost Advice

"Have a bank of licenses, because it is about the number of objects (RAM, ports, CPU, etc.)."

"The pricing has not evolved with the market, which is one of the reasons we are moving to a new product."

"The tool is not expensive. We were able to negotiate with SevOne on pricing."

"A blocking point is the high upfront cost because it is challenging to get it accepted and the purchase approved."

"Choose a SevOne partner who can provide SevOne as a service and can deliver professional services and maintenance."

"It is inexpensive compared to other monitoring tools."

"The pricing has been fair."

"Many tools price things based on the number of KPIs that you're collecting around a device. In many cases, there could be hundreds of metrics that you need to collect. SevOne provides device-level pricing. That gives us the flexibility to turn on, and expand on, the metrics that we're collecting around those devices, without taking a financial hit."

More IBM SevOne Network Performance Management (NPM) pricing and cost advice

"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."

"The product price was reasonable for my region and the market."

"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."

"It is cheap."

"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."

"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."

"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."

"It’s cheaper to run virtual machines in a VMware environment."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

859,129 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

15%

Manufacturing Company

15%

Computer Software Company

13%

Legal Firm

Computer Software Company

18%

Financial Services Firm

18%

Government

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What needs improvement with SevOne Network Data Platform?

There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...

What is your primary use case for SevOne Network Data Platform?

The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...

What advice do you have for others considering SevOne Network Data Platform?

To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

Instana Infrastructure Monitoring vs IBM SevOne Network Performance Management (NPM)

Comparisons

Compared 10% of the time

Zabbix vs IBM SevOne Network Performance Management (NPM)

Compared 8% of the time

NETSCOUT nGeniusONE vs IBM SevOne Network Performance Management (NPM)

Compared 8% of the time

Splunk Enterprise Security vs IBM SevOne Network Performance Management (NPM)

Compared 7% of the time

SolarWinds Network Device Monitor vs IBM SevOne Network Performance Management (NPM)

Compared 7% of the time

More IBM SevOne Network Performance Management (NPM) Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 22% of the time

IBM Security QRadar vs NetWitness Platform

Compared 19% of the time

Elastic Security vs NetWitness Platform

Compared 13% of the time

RSA enVision vs NetWitness Platform

Compared 10% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 8% of the time

More NetWitness Platform Competitors

Product Reports

IBM SevOne Network Performance Management (NPM)

Download IBM SevOne Network Performance Management (NPM) product report

IBM SevOne Network Performance Management (NPM) report

NetWitness Platform

Download NetWitness Platform product report

Also Known As

SevOne

RSA Security Analytics

Overview

The IBM® SevOne Network Performance Management (IBM SevOne NPM) solution helps you spot, address, and prevent network performance issues early with machine learning-powered analytics from a single source. Boost network performance and improve your user application experience by proactively monitoring your multivendor end-to-end network across enterprise, communication, and managed service provider networks.

Transform raw network performance data into intelligent and actionable insights. The IBM SevOne NPM solution goes beyond detection, combining industry-leading expertise and advanced technology to help your IT team plan and optimize your network and act on what matters: improving network performance to provide an exceptional customer experience.

For further information, please visit www.ibm.com/cloud/sevo...

IBM

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)

Los Angeles World Airports, Reply

IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform