No more typing reviews! Try our Samantha, our new voice AI agent.

IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

IBM SevOne Network Performa...
Ranking in Log Management
41st
Average Rating
8.4
Reviews Sentiment
7.2
Number of Reviews
54
Ranking in other categories
Network Monitoring Software (39th), Server Monitoring (17th), IT Infrastructure Monitoring (42nd), Cloud Monitoring Software (31st)
NetWitness Platform
Ranking in Log Management
32nd
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Security Information and Event Management (SIEM) (34th)
 

Mindshare comparison

As of April 2026, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 1.0%, up from 0.3% compared to the previous year. The mindshare of NetWitness Platform is 0.9%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
NetWitness Platform0.9%
IBM SevOne Network Performance Management (NPM)1.0%
Other98.1%
Log Management
 

Featured Reviews

Grzegorz Nowak - PeerSpot reviewer
Solution Architect at Wingu
Improves infrastructure planning by helping us analyze network traffic
We use SevOne to collect and report on network flows SevOne improves infrastructure planning by helping us analyze network traffic. We can look at bandwidth for specific endpoints on the customer's network and analyze traffic to identify issues. For example, maybe some connectors are unavailable.…
reviewer2256927 - PeerSpot reviewer
Head of Information Security, Cyber Defense and IT Risk Management at HCT. at a transportation company with 201-500 employees
A solid SIEM solution that should improve technical support and online resources to be easier to use
A big problem with the product is that we don't have much professional experience in Israel installing, implementing, and integrating this product. There is not enough of a knowledge base. There is no support for this product in this country, so problems have to be resolved through global technical teams. We like to work locally because of the language, and when the product is only supported outside the country, it's a little difficult to implement and use this product. Moreover, AI is something that must be added immediately. Artificial intelligence is a part of the competitors' products, and it's not been implemented for us.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I don't think the product cost compares to the savings we get by detecting a problem and resolving a problem faster."
"It is a very efficient and highly recommended solution."
"SevOne enables us to look at the data and see that the customer has disconnected so we can stop billing and reimbursing them."
"SevOne is one of the biggest strategic investments we've made; it just works, it just does what we want with no fuss about it."
"The most valuable features for us are the huge number of network devices it can monitor."
"SevOne is excellent for transforming raw network performance data into actionable insights."
"SevOne provides us with continuous analytics of our network and that gives us an idea of the health of our network, where our weaknesses are, and what needs to be fixed."
"It also gives us the closest thing to real-time insight into network performance that we have, with just a 10-second delay. It's very important for us to know the health of the infrastructure very quickly."
"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."
"The product has a user-friendly interface and a valuable feature for threat intelligence integration."
"RSA NetWitness is a SIEM and real-time network traffic solution that collects logs and packets, applies a set of alerting, reporting, and analysis rules on them, and thus provides the enterprise with full visibility of the networks and activities of the systems."
"The most valuable feature is the correlation, as it can report in real-time and monitor the management."
"The most valuable features are the packet decoder, log decoder, and concentrator."
"Technically speaking, this is a good product."
"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
 

Cons

"If you want one tool for everything this should not be considered."
"Their virtualization solution is not compatible with our Kubernetes environment, which is one of the reasons we are ending our relationship with them."
"The only thing that worries me with SevOne is that they were acquired by Turbonomic and now by IBM."
"Setup was very complex as there were issues with the device pipes. We needed a lot of intervention and technical assistance."
"I would like to see live maps as an added feature. Also, build modules on AI and EML to provide better data insights that would proactively tell us what we should be looking after."
"I'm not really sure if this was the software's fault or a server issue, but a couple of years back the disks were failing on our SevOne physical server every month and the server would go down. The secondary server took over from the primary until the disk issue was resolved. That was annoying."
"The UI is a little dated, but it doesn’t cause any features to fall short of what they need to do."
"SevOne should work with the graphs legend functionality."
"The solution should have more integration capabilities with different platforms."
"Its technical support could be better."
"The initial setup is very complex and should be simplified."
"The solution should have more integration capabilities with different platforms."
"Security needs improvement. We would still like to know how the traffic is entering the organization."
"The tool's integration capability isn't so great."
"We have encountered issues with unresolved crashes."
"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."
 

Pricing and Cost Advice

"There are different options available for licensing, with the per-device option being more expensive but more flexible."
"The pricing has been fair."
"Prices per license are not huge, but they exist."
"Choose a SevOne partner who can provide SevOne as a service and can deliver professional services and maintenance."
"For the value that you get from SevOne, it's worth the price. There are a lot of cheaper alternatives on the market, and even free options. But they require more staff, more resources, and engineers with more advanced knowledge of monitoring. That's what makes SevOne worth the price."
"The pricing has not evolved with the market, which is one of the reasons we are moving to a new product."
"The tool is not expensive. We were able to negotiate with SevOne on pricing."
"There are cheaper solutions available."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"We are on an annual license for the use of the solution."
"It’s cheaper to run virtual machines in a VMware environment."
"The product is expensive."
"The licenses are good but the cost is very expensive."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"Our license is for one year."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
886,719 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Manufacturing Company
12%
Construction Company
10%
Computer Software Company
6%
Financial Services Firm
12%
Construction Company
8%
Performing Arts
7%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise6
Large Enterprise45
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What needs improvement with SevOne Network Data Platform?
There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...
What is your primary use case for SevOne Network Data Platform?
The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...
What advice do you have for others considering SevOne Network Data Platform?
To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

SevOne
RSA Security Analytics
 

Overview

 

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)
Los Angeles World Airports, Reply
Find out what your peers are saying about IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform and other solutions. Updated: April 2026.
886,719 professionals have used our research since 2012.