Try our new research platform with insights from 80,000+ expert users

ManageEngine NetFlow Analyzer vs NetWitness NDR comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

ManageEngine NetFlow Analyzer
Average Rating
9.6
Reviews Sentiment
3.9
Number of Reviews
2
Ranking in other categories
Network Troubleshooting (10th), Network Traffic Analysis (NTA) (10th)
NetWitness NDR
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (59th), Threat Intelligence Platforms (41st), Endpoint Detection and Response (EDR) (60th), Security Orchestration Automation and Response (SOAR) (25th), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (40th)
 

Mindshare comparison

ManageEngine NetFlow Analyzer and NetWitness NDR aren’t in the same category and serve different purposes. ManageEngine NetFlow Analyzer is designed for Network Troubleshooting and holds a mindshare of 2.8%, up 1.5% compared to last year.
NetWitness NDR, on the other hand, focuses on Network Detection and Response (NDR), holds 2.4% mindshare, up 1.7% since last year.
Network Troubleshooting Market Share Distribution
ProductMarket Share (%)
ManageEngine NetFlow Analyzer2.8%
LinkRunner13.6%
Wireshark12.6%
Other71.0%
Network Troubleshooting
Network Detection and Response (NDR) Market Share Distribution
ProductMarket Share (%)
NetWitness NDR2.4%
Darktrace22.7%
Vectra AI15.6%
Other59.300000000000004%
Network Detection and Response (NDR)
 

Featured Reviews

Aneesh Mangla - PeerSpot reviewer
High cost-effectiveness and reliable alerting ensure proactive network management
Sometimes customers are unaware about their own network. For example, we need SMTP credentials for Layer 2 switches to do automatic discovery of network devices. Sometimes the network management teams are unaware of their SMTP credentials because the teams have been shuffled since the network was deployed. Or sometimes, when we support our government and defense customers, they don't have clearance to share these credentials with us. Some of the features, such as auto discoverability, get hampered if the customer is not aware of their own network or somehow can't share privileges and credentials with our tool for them to work properly. Not in ManageEngine NetFlow Analyzer in particular, but there are other features of the OpManager suite that could afford to be updated. There is something called a CLI, command-line interface, that allows us to configure network devices such as switches. This is old technology. This product suite has CLI-based configurations, but as of last year, most network devices come with Zero Touch Provisioning (ZTP). OpManager does not support this functionality, and we don't really have a timeline on when ZTP functionality will be available. In ManageEngine NetFlow Analyzer, we have to set custom thresholds to get alerted if there is a problem in network connectivity. It would be helpful if we could automate the tool such that we don't have to set thresholds manually, and the tool automatically alerts us when it detects issues. When experts deploy this tool, we already know what thresholds should be normal. But customers in general may not have this skill set. For newer customers who need to adopt this product, an automated method of alerting would definitely be beneficial.
SupravatMaji - PeerSpot reviewer
Beneficial single unified dashboard, good native application integration, and high availability
My advice to those wanting to implement RSA NetWitness Network is they have to first do a little due diligence, such as the exact requirement based on their needs. That will give them a direction for their investment because otherwise, the bill of material or bill of quantity (BOQ) may be higher side. It is important to do good due intelligence on the environment, see the exact requirement, and then go ahead with the solution. The solution is perfectly stable. I rate RSA NetWitness Network a nine out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"ManageEngine NetFlow Analyzer has detection capabilities for flow, event, and service flow."
"I give this solution a rating of 10 out of 10 and absolutely recommend it based on our experience."
"This solution allows us to locate the malware in real-time."
"The stability of the RSA NetWitness Endpoint is very good."
"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."
"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."
"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."
"Ability to isolate the machine when there are malicious files."
"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."
"The interface of this solution is very flexible and easy to use."
 

Cons

"In ManageEngine NetFlow Analyzer, we have to set custom thresholds to get alerted if there is a problem in network connectivity. It would be helpful if we could automate the tool such that we don't have to set thresholds manually, and the tool automatically alerts us when it detects issues."
"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious."
"Threat detection could be better."
"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"The contamination feature could be improved."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"RSA NetWitness Network could improve on integration with non-native application integration."
"The solution lacks a reporting engine."
"The threat intelligence could improve in RSA NetWitness Endpoint."
 

Pricing and Cost Advice

Information not available
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"It is highly scalable. It can be bought based on your requirements."
"I do not have any opinion on the pricing or licensing of the product."
"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"We are on a three-year contract to use RSA NetWitness Network."
"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
report
Use our free recommendation engine to learn which Network Troubleshooting solutions are best for your needs.
867,370 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Energy/Utilities Company
15%
Educational Organization
11%
Construction Company
9%
Financial Services Firm
13%
Computer Software Company
12%
Manufacturing Company
9%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise5
 

Questions from the Community

What needs improvement with ManageEngine NetFlow Analyzer?
ManageEngine's product has some performance issues. It runs very slowly when the system is large and does not support high availability for big flow and high-level operations. The product needs imp...
What is your primary use case for ManageEngine NetFlow Analyzer?
I use ManageEngine NetFlow Analyzer for detecting the root cause when the database and application run very slow. I have not yet used the traffic shaping feature of ManageEngine NetFlow Analyzer.
Ask a question
Earn 20 points
 

Also Known As

No data available
RSA ECAT, NetWitness Network
 

Overview

 

Sample Customers

Metro Rail, Micron21, Lotus F1 Team, Elizabeth Board of Education, Queen’s University Belfast, DHL, Praxair, Adventist Health, Wipro Infotech, Tropical Shipping USA
ADP, Ameritas, Partners Healthcare
Find out what your peers are saying about Auvik, NetAlly, Wireshark and others in Network Troubleshooting. Updated: August 2025.
867,370 professionals have used our research since 2012.