No more typing reviews! Try our Samantha, our new voice AI agent.

LevelBlue USM Anywhere vs NetWitness Platform comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 24, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

LevelBlue USM Anywhere
Ranking in Log Management
28th
Ranking in Security Information and Event Management (SIEM)
29th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
115
Ranking in other categories
Endpoint Detection and Response (EDR) (37th), Compliance Management (14th)
NetWitness Platform
Ranking in Log Management
36th
Ranking in Security Information and Event Management (SIEM)
34th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of September 2026, in the Log Management category, the mindshare of LevelBlue USM Anywhere is 1.4%, up from 0.4% compared to the previous year. The mindshare of NetWitness Platform is 1.1%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
USM Anywhere1.4%
NetWitness Platform1.1%
Other97.5%
Log Management
 

Featured Reviews

Kris Nawani - PeerSpot reviewer
Co-Founder/Director at Bangkok MSP Company Limited
Offers complete coverage without the need to install additional software
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools The solution offers complete coverage without the need to install additional software, as it is maintained by the vendor. It helps in saving…
reviewer2256927 - PeerSpot reviewer
Head of Information Security, Cyber Defense and IT Risk Management at HCT. at a transportation company with 201-500 employees
A solid SIEM solution that should improve technical support and online resources to be easier to use
A big problem with the product is that we don't have much professional experience in Israel installing, implementing, and integrating this product. There is not enough of a knowledge base. There is no support for this product in this country, so problems have to be resolved through global technical teams. We like to work locally because of the language, and when the product is only supported outside the country, it's a little difficult to implement and use this product. Moreover, AI is something that must be added immediately. Artificial intelligence is a part of the competitors' products, and it's not been implemented for us.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The new cloud-based panel is excellent both for client review as well as for our SOC to review and respond to threats. It is much easier to configure and use than the previous solution from AlienVault.​"
"It has tremendous benefits, and it brings everything into one single pane that includes your vulnerability management, asset management, IDS, logs, and correlation."
"We have a better detection rate for malware and other cyber-attacks, and it really helps when USM is integrated in the incident response plan."
"OTX is a great module that lets staff maintain and monitor updates regarding events in the infrastructure and takes decision to improve the security perimeter."
"The product has been very stable."
"Its powerful correlation engine helps reduce time in manually correlating events."
"AlienVault support is what really makes this product a great investment."
"AlientVault has helped us in improving our visualization and incident response during cybersecurity situations."
"Technical support is very good; they try to resolve issues with the proper SLAs which are defined by them and they understand the client's requirements as well as the client's infrastructure in a better manner."
"The most valuable features are the packet inspection and the automated incident response."
"The most valuable feature is the security that it provides."
"The most valuable features are its ingestion of logs and raising of alerts based on those logs."
"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"
"Stability has not been an issue with this product."
"Once it is deployed and you are used to it, you can do whatever you want."
"NetWitness can be highly beneficial for incident detection and response."
 

Cons

"I think they need to broaden their compliance management to cover more areas of compliance."
"I've been using it just for my own personal upskilling in terms of how the product works. At the moment, it is pretty straightforward and simple, and it is working how it is supposed to. The feedback would come once it is deployed to customer sites. They'll be using it on a more frequent basis, and that's when the feedback would come in terms of the areas in which they're facing issues or are looking for simplicity."
"Although they use machine learning, the algorithms that they use are graph-based."
"The only complex area of the setup was writing the custom scripts."
"Product stability: The biggest issue we have seen with the product is its poor stability. Every version upgrade is a nightmare."
"The UI and overall processes need a little bit more love. This shows in the error banners that come up when you select certain things. There isn't a day that goes by that the UI doesn't error out and I can't view events for an alarm."
"We have encountered stability issues; we have a high volume of logs passing through our SIEM and the default configuration couldn't handle all the data."
"One of the problems we had with stability was a problem of our own."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."
"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."
"More customizability is required, which is something that they need to improve on."
"It is overly complicated. It has taken years to implement and the return on investment just isn't there."
"We encountered stability issues in the earlier versions, and much fewer in the newer versions."
"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
 

Pricing and Cost Advice

"Its price is much lower than McAfee ESM."
"So far, I feel the product's pricing is a good value. The technology is decent. You get what you pay for. I think it's fair."
"They charge a license based on the storage. ATT AlienVault USM is a less expensive solution than IBM QRadar."
"It allows you to do a lot with a small price tag... The pricing is the best on the market."
"We pay around $12,000 a year including storage."
"So far, it has been a good solution for a tight budget."
"AlienVault is flexible on their pricing for unlimited licenses."
"The pricing is a good value. The key thing is that for the new product, the licensing of it, is subscription-based and it's based on data. Clients need to be really careful when thinking about that, because odds are they're going to need to put a lot more data into it than what they initially estimate, which is going to drive their subscription costs up."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
"The licenses are good but the cost is very expensive."
"The product is expensive."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"The tool is very expensive, so I rate the pricing a ten out of ten. The solution has an annual subscription."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
914,109 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Construction Company
20%
Outsourcing Company
18%
Comms Service Provider
8%
Financial Services Firm
7%
Construction Company
13%
Financial Services Firm
11%
Comms Service Provider
11%
Outsourcing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business65
Midsize Enterprise29
Large Enterprise25
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What needs improvement with AT&T AlienVault USM?
There are scalability issues due to a 60 TB limit, which restricts its use for large customers like banks. It is also limited when used with bigger products and has complex password requirements.
What is your primary use case for AT&T AlienVault USM?
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

AT&T AlienVault USM, AlienVault, AlienVault USM, Alienvault Cybersecurity
RSA Security Analytics
 

Overview

 

Sample Customers

Abel & Cole, Bank of Ireland, Bluegrass Cellular, CareerBuilder, Claire's, Hays Medical Center, Hope International, McCurrach, McKinsey & Company, Party Delights, Pepco Holdings, Richland School District, Ricoh, SaveMart, Shake Shack, Steelcase, TaxAct, Taylor Morrison, Vonage and Zoom
Los Angeles World Airports, Reply
Find out what your peers are saying about LevelBlue USM Anywhere vs. NetWitness Platform and other solutions. Updated: September 2026.
914,109 professionals have used our research since 2012.