Try our new research platform with insights from 80,000+ expert users

LogRhythm SIEM vs Logsign Next-Gen SIEM vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

As of June 2025, in the Log Management category, the mindshare of LogRhythm SIEM is 2.1%, down from 3.2% compared to the previous year. The mindshare of Logsign Next-Gen SIEM is 0.3%, down from 0.3% compared to the previous year. The mindshare of NetWitness Platform is 0.3%, down from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management
 

Featured Reviews

Mokhammad Rakhman - PeerSpot reviewer
User-friendly dashboard and machine learning capabilities improve threat hunting efficiency
LogRhythm SIEM has strong machine-learning capabilities with behavioral rules and analysis. The seamless integration for case management, along with a user-friendly dashboard user interface, makes tasks like threat hunting more efficient. Analytics and behavioral analysis help me save time with rule creation. Its scalability allows me to add components as needed. Overall, LogRhythm SIEM offers end-to-end visibility with a reasonable price.
Ayaz Ahmed - PeerSpot reviewer
Works well for threat detection and security
Improvements needed in Logsign SIEM are providing specific security alerts that can be filtered and configured more effectively. There should be a focus on delivering alerts tailored to specific needs rather than overwhelming users with numerous alerts. Additionally, incorporating more mature data about threats is necessary for better threat detection.
MOTASHIM Al Razi - PeerSpot reviewer
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The user interface is good."
"It's very easy to create the correlation rules with LogRhythm, and there are some advanced features like SIEM and UEBA, which are also very valuable."
"The major feature of this solution is its easy configuration which helps different team members to work on it effectively. This kind of feature is not available in other solutions because of a request for specialised schemes for configuration report extraction and searching. Another feature that I really admire is the significant improvement in the compliance in the auditing process by the solution. Our organisation-specific complaints require where the mailbox data needs to be forwarded, stored and searchable for a certain time period. This solution categorises data based on different types, which include cold, warm and hot data. These features allow faster and easier extraction of any data even if the event was occurring several years ago. I also like other features, especially user behaviour analysis and automation. If suddenly someone accesses your side or an unusual traffic is recorded from a user the solution flags it very effectively."
"The user interface is pretty good compared to other SIEM tools."
"The feature that makes it usable is the web interface."
"It allows us to automate a lot of things with a smaller team."
"One of the main features that I like about LogRhythm NextGen SIEM is that there are a lot of pre-built pieces. Like with our AV, we didn't have to tell it how to read the logs; they already had it pre-made. So, we essentially just had to follow their guide to get the logs imported in and set up some rules for it. We've only had to manually create the parsing rules for a few of our vendors so that we could interpret the logs correctly. Most of them had already been pre-created for us."
"The dashboards in the LogRhythm SIEM really help us as a starting point. It gives us a starting point we can go to every day. We walk through several dashboards to see anomalous activity for further investigation."
"Logsign provides sample logs within the product, allowing users to see how logs will appear before integration, which is a valuable feature for testing and understanding log formats."
"The most valuable features of Logsign SIEM are its cloud capabilities, alerting functionality, integration with Elastic Search, and configuration options."
"It has full automation and automated SIEM responses."
"The product's initial setup phase was not at all difficult."
"Their technical support responds quickly and are knowledgable."
"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."
"The most valuable features are the packet inspection and the automated incident response."
"The most valuable features are the integration and ease of use."
"NetWitness Platform is valuable for creating rules that the solution must detect."
"NetWitness can be highly beneficial for incident detection and response."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
 

Cons

"We would like to see more things out of the console into the web UI. I guess this is what they are doing in 7.4."
"Scalability-wise, it's not that great."
"We're still struggling to get a real return on it and finding something that isn't false noise."
"LogRhythm's SOAR and NDR features don't stack up well against competitors. maybe integrating theme functionality as the other do. But in general, it's okay."
"The security playbook could be pre-defined and available to other analysts with similar security issues."
"The software needs to work on its pricing."
"Appliance-based setups can sometimes pose scalability issues"
"LogRhythm SIEM needs improvement in data grouping and manipulation capabilities."
"I hope they address the pricing model for Logsign Next-Gen SIEM, especially regarding regional variations. The pricing should not differ based on the country of operation as it can lead to dissatisfaction among customers. A fixed pricing structure would be more favorable for us. I would also suggest enhancing the GUI interface and adding features similar to xFi Exchange from IBM Pure. This would streamline operations and save time for analysts."
"Improvements needed in Logsign SIEM are providing specific security alerts that can be filtered and configured more effectively."
"AI and machine learning need to be developed. If they develop those features, I think everything will be fine."
"The product's licensing models are complex to understand. This particular area needs improvement."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
"Nowadays, their support is a little subpar compared to other solutions. I rate RSA support six out of 10."
"The initial setup is complex. There are other solutions that are easier to implement."
"The implementation needs assistance."
"There are instances where you try to run the reports and then it does not give you the desired outcome."
"The initial setup was complex because it takes a lot of time to complete the implementation."
"The system looks like it is a mix of a bunch of different systems, and nothing looked like it was quite together."
 

Pricing and Cost Advice

"I would rate the pricing 4 out of 5. There are no additional costs to the standard licensing fees."
"I give the price a six out of ten."
"We have seen a measurable decrease in the mean time to detect and respond to threats. As it comes out new features and new releases, the window is becoming a lot narrower because you can pivot a lot more with the data. Therefore, the new features and enhancements are reducing that."
"LogRhythm's licensing is based on MPS. There are some add-on features like advanced UEBA, the cloud component for advanced UEBA, and SIEM."
"On a scale of one to ten, where one is low, and ten is high, I rate the pricing between six and seven."
"I have seen a measurable decrease in the mean time to detect and respond to threats. We went from not detecting them to detecting them. We can actually pick up what is anomalous in our network now."
"LogRhythm's pricing and licensing is extremely competitive and it's one of the top three reasons we continue to invest in the platform."
"The setup and licensing for small and medium size businesses is straightforward, though when it comes to the enterprise it pays to keep in mind the possibility for complications given all the extras and add-ons that may be required."
"Compared to other SIEMs, it has low pricing."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"It is cheap."
"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."
"The product is expensive."
"The product price was reasonable for my region and the market."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
856,856 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
10%
Government
9%
Manufacturing Company
8%
Computer Software Company
13%
Comms Service Provider
12%
Government
9%
University
7%
Computer Software Company
19%
Financial Services Firm
17%
Government
6%
Energy/Utilities Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What is the difference between log management and SIEM?
Rony, Daniel's answer is right on the money. There are many solutions for each in the market, a lot depends upon you...
What needs improvement with LogRhythm NextGen SIEM?
I cannot think of any specific features that LogRhythm SIEM can improve upon since it supports a wide variety of majo...
What do you like most about LogRhythm SIEM?
I find LogRhythm's log management capabilities to be beneficial.
What needs improvement with Logsign Next-Gen SIEM?
It does not have much AI and machine learning features yet. They are developing them and will be releasing them in a ...
What is your primary use case for Logsign Next-Gen SIEM?
We use Logsign SIEM for various tasks in our daily operations. One key use case is for forensic analysis. We also use...
What advice do you have for others considering Logsign Next-Gen SIEM?
Overall, I would rate it an eight out of ten. AI and machine learning need to be developed. If they develop those fea...
What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to...
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem )...
 

Also Known As

LogRhythm NextGen SIEM, LogRhythm, LogRhythm Threat Lifecycle Management, LogRhythm TLM
No data available
RSA Security Analytics
 

Overview

 

Sample Customers

Macy's, NASA, Fujitsu, US Air Force, EY, Abbott, HD Supply, SAB Miller, UCLA, Raytheon, Amtrak, Cargill
Turkish Petroleum, Tırsan, DP World, SAC American Colleges, Robert College, Unlu&Co, UniCo Insurance Company, ETSTur, CK Energy, UEDAS Energy, Wilo, Eurocross Assistance, Deloitte Turkey, Incı GS Yuasa, Pappara, Bilgi University, Anadolu University, İstanbul University, The Ministry of Energy and Natural Resources, TRT, Anadolu Media Agency, Ministry of Family, Labour and Social Services, Ispark, Spor AS and wide range of enterprises in different industries. 
Los Angeles World Airports, Reply
Find out what your peers are saying about Wazuh, Splunk, Datadog and others in Log Management. Updated: May 2025.
856,856 professionals have used our research since 2012.