No more typing reviews! Try our Samantha, our new voice AI agent.

LevelBlue USM Anywhere vs NetWitness Platform comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 24, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

LevelBlue USM Anywhere
Ranking in Log Management
27th
Ranking in Security Information and Event Management (SIEM)
26th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
115
Ranking in other categories
Endpoint Detection and Response (EDR) (33rd), Compliance Management (12th)
NetWitness Platform
Ranking in Log Management
36th
Ranking in Security Information and Event Management (SIEM)
34th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2026, in the Log Management category, the mindshare of LevelBlue USM Anywhere is 1.6%, up from 0.5% compared to the previous year. The mindshare of NetWitness Platform is 1.2%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
LevelBlue USM Anywhere1.6%
NetWitness Platform1.2%
Other97.2%
Log Management
 

Featured Reviews

Kris Nawani - PeerSpot reviewer
Co-Founder/Director at Bangkok MSP Company Limited
Offers complete coverage without the need to install additional software
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools The solution offers complete coverage without the need to install additional software, as it is maintained by the vendor. It helps in saving…
reviewer1130436 - PeerSpot reviewer
Information Technology Security and Infrastructure Expert at a government with 201-500 employees
Helps to deal with potential attacks and is available at a reasonable price
My company has had many benefits from the use of the product in the last eight years. The tool has streamlined our company's incident response process since it serves as a log repository, which allows us to correlate events and access different technology stacks. In our company, we were able to actually find some potential attacks, so it has been very helpful. The tool's integration capability isn't so great. In my company, we managed to integrate it with our Microsoft Azure Subscription, after which we managed to integrate it with other tools. You will face a lot of difficulties if you want to integrate it with your database monitoring tool, PAM solutions, or IAM products. The product has done well overall for my company's teams to deal with their workflow efficiency. I would not recommend the product to others. I rate the tool a seven out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Beyond provided us with an IDS as was our initial need, but AlienVault gave us more useful resources, as SIEM, and as a vulnerability scanner (the last, one of my favourite resources)."
"Reports are customized, so you can present them to executives or engineers.​"
"Pricing was a very important consideration and lower than the other SIEM solutions evaluated."
"The pricing and licensing are at its best in the market when compared with other vendor's SIEM products."
"Vulnerability scanning helped out shortcomings of what was not patched in the past and what needed to be patched. This assisted with fine tuning the environment for compliance."
"ATT AlienVault USM support is very good, they respond quickly to our needs."
"It has allowed us to see what is happening on our servers."
"It has tremendous benefits, and it brings everything into one single pane that includes your vulnerability management, asset management, IDS, logs, and correlation."
"The detection of ransomware in the internal network has benefited my organization."
"The most valuable feature is the hunting ability to work in a CERT."
"The solution is reliable."
"Once it is deployed and you are used to it, you can do whatever you want."
"The most valuable features are the threat prediction and network forensics."
"It gives customers visibility about their most important servers and devices."
"NetWitness Platform is valuable for creating rules that the solution must detect."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
 

Cons

"In emergency cases, it is difficult to reach them."
"More complimentary training needs to be done for use with this tool. If you get into a bind, then it will cost you."
"The one thing I continue to dislike about the USM is the limitation on reports."
"Its reporting tools need improvements."
"One of the problems we had with stability was a problem of our own."
"The price of AT&T AlienVault USM could be reduced."
"For creating new rules, you have to be familiar with regular expressions. I feel there could be something built-in to make sure that process is easier."
"AlienVault must improve their correlation feature. Some of the events do not match with the correlation rules and some of the correlation events are false-positive."
"RSA NetWitness Logs and Packets can improve the threat level aspect, it is lacking compared to other solutions."
"It is not so easy to customize this product."
"Advance monitoring and alerting feature is not stable (Event Stream Analysis)."
"There is no support for this product in this country, so problems have to be resolved through global technical teams."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
"The product continues to crash. Even with tech support help, it does not resolve itself."
"One thing to be improved in NetWitness is the capability to correlate event logs in a general sense."
"An area for improvement would be better automation and more inbuilt use cases."
 

Pricing and Cost Advice

"So far, I feel the product's pricing is a good value. The technology is decent. You get what you pay for. I think it's fair."
"The price for this solution is very good, but since the features do not work the price is expensive."
"The licensing fees are dependent on usage."
"It's very reasonably priced. It was one of the lowest among the ones I looked at. Licensing is pretty flexible. They can do a two-year or a three-year, even a one-year, perhaps."
"AT&T AlienVault USM is an expensive solution and we pay for the license and the support separately. We paid for the license and support for three years."
"Negotiate the best package for your environment."
"The price of this solution is reasonable, which is one of the reasons why we selected it over other solutions."
"I don't know exactly, but I know it is based on the number of logs and the retention duration, such as 30 days or something like that. So, the smallest package is about 500 a month for 30 days of logs. There is a virtual machine. You need resources for it. It is a log collecting VM. They provide the software, and you just have to load a virtual machine. So, you're going to incur some CPU RAM and storage for wherever this log collecting appliance is running, which typically is in our cloud and on our platform for the customer."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"We are on an annual license for the use of the solution."
"The product price was reasonable for my region and the market."
"Our license is for one year."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
921,523 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Outsourcing Company
16%
Construction Company
16%
Comms Service Provider
9%
Manufacturing Company
9%
Construction Company
12%
Financial Services Firm
11%
Comms Service Provider
11%
Outsourcing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business65
Midsize Enterprise29
Large Enterprise25
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What needs improvement with AT&T AlienVault USM?
There are scalability issues due to a 60 TB limit, which restricts its use for large customers like banks. It is also limited when used with bigger products and has complex password requirements.
What is your primary use case for AT&T AlienVault USM?
USM Anywhere is used for threat detection and investigation. It provides a solution with built-in threat intelligence and various other investigation tools.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

AT&T AlienVault USM, AlienVault, AlienVault USM, Alienvault Cybersecurity
RSA Security Analytics
 

Overview

 

Sample Customers

Abel & Cole, Bank of Ireland, Bluegrass Cellular, CareerBuilder, Claire's, Hays Medical Center, Hope International, McCurrach, McKinsey & Company, Party Delights, Pepco Holdings, Richland School District, Ricoh, SaveMart, Shake Shack, Steelcase, TaxAct, Taylor Morrison, Vonage and Zoom
Los Angeles World Airports, Reply
Find out what your peers are saying about LevelBlue USM Anywhere vs. NetWitness Platform and other solutions. Updated: November 2026.
921,523 professionals have used our research since 2012.