Try our new research platform with insights from 80,000+ expert users

ManageEngine NetFlow Analyzer vs NetWitness NDR comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

ManageEngine NetFlow Analyzer
Average Rating
9.6
Reviews Sentiment
3.9
Number of Reviews
2
Ranking in other categories
Network Troubleshooting (10th), Network Traffic Analysis (NTA) (10th)
NetWitness NDR
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (59th), Threat Intelligence Platforms (TIP) (40th), Endpoint Detection and Response (EDR) (63rd), Security Orchestration Automation and Response (SOAR) (25th), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (37th)
 

Mindshare comparison

ManageEngine NetFlow Analyzer and NetWitness NDR aren’t in the same category and serve different purposes. ManageEngine NetFlow Analyzer is designed for Network Troubleshooting and holds a mindshare of 2.9%, up 1.6% compared to last year.
NetWitness NDR, on the other hand, focuses on Network Detection and Response (NDR), holds 2.6% mindshare, up 1.7% since last year.
Network Troubleshooting Market Share Distribution
ProductMarket Share (%)
ManageEngine NetFlow Analyzer2.9%
Wireshark13.0%
LinkRunner12.7%
Other71.4%
Network Troubleshooting
Network Detection and Response (NDR) Market Share Distribution
ProductMarket Share (%)
NetWitness NDR2.6%
Darktrace22.3%
Vectra AI15.6%
Other59.5%
Network Detection and Response (NDR)
 

Featured Reviews

Aneesh Mangla - PeerSpot reviewer
High cost-effectiveness and reliable alerting ensure proactive network management
Sometimes customers are unaware about their own network. For example, we need SMTP credentials for Layer 2 switches to do automatic discovery of network devices. Sometimes the network management teams are unaware of their SMTP credentials because the teams have been shuffled since the network was deployed. Or sometimes, when we support our government and defense customers, they don't have clearance to share these credentials with us. Some of the features, such as auto discoverability, get hampered if the customer is not aware of their own network or somehow can't share privileges and credentials with our tool for them to work properly. Not in ManageEngine NetFlow Analyzer in particular, but there are other features of the OpManager suite that could afford to be updated. There is something called a CLI, command-line interface, that allows us to configure network devices such as switches. This is old technology. This product suite has CLI-based configurations, but as of last year, most network devices come with Zero Touch Provisioning (ZTP). OpManager does not support this functionality, and we don't really have a timeline on when ZTP functionality will be available. In ManageEngine NetFlow Analyzer, we have to set custom thresholds to get alerted if there is a problem in network connectivity. It would be helpful if we could automate the tool such that we don't have to set thresholds manually, and the tool automatically alerts us when it detects issues. When experts deploy this tool, we already know what thresholds should be normal. But customers in general may not have this skill set. For newer customers who need to adopt this product, an automated method of alerting would definitely be beneficial.
SupravatMaji - PeerSpot reviewer
Beneficial single unified dashboard, good native application integration, and high availability
My advice to those wanting to implement RSA NetWitness Network is they have to first do a little due diligence, such as the exact requirement based on their needs. That will give them a direction for their investment because otherwise, the bill of material or bill of quantity (BOQ) may be higher side. It is important to do good due intelligence on the environment, see the exact requirement, and then go ahead with the solution. The solution is perfectly stable. I rate RSA NetWitness Network a nine out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"ManageEngine NetFlow Analyzer has detection capabilities for flow, event, and service flow."
"I give this solution a rating of 10 out of 10 and absolutely recommend it based on our experience."
"The most valuable feature is the way it captures the traffic, and it contains every detail of the communication."
"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."
"The interface of this solution is very flexible and easy to use."
"The stability of the RSA NetWitness Endpoint is very good."
"Ability to isolate the machine when there are malicious files."
"It is stable. We have been using it for some time, without any issues."
"It is very easy to use, and its usability is great. The use cases are also very easy. The visualizations of the use cases are magnificent. You cannot find this in any other solution. From my point of view, it is great."
"Technical support is knowledgeable."
 

Cons

"In ManageEngine NetFlow Analyzer, we have to set custom thresholds to get alerted if there is a problem in network connectivity. It would be helpful if we could automate the tool such that we don't have to set thresholds manually, and the tool automatically alerts us when it detects issues."
"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"The threat intelligence could improve in RSA NetWitness Endpoint."
"The deployment process is complex. I don't know why, but this solution will suddenly stop working. Logs stop coming. Often, one thing or another stops working. Most of the time, one of my team members is working with troubleshooting and working with technical support. Log passing is also one of the biggest challenge."
"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."
"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious."
"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"RSA NetWitness Network could improve on integration with non-native application integration."
 

Pricing and Cost Advice

Information not available
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"I do not have any opinion on the pricing or licensing of the product."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"It is highly scalable. It can be bought based on your requirements."
"We are on a three-year contract to use RSA NetWitness Network."
"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."
report
Use our free recommendation engine to learn which Network Troubleshooting solutions are best for your needs.
869,952 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
19%
Energy/Utilities Company
13%
Educational Organization
13%
Construction Company
9%
Financial Services Firm
13%
Computer Software Company
12%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise5
 

Questions from the Community

What needs improvement with ManageEngine NetFlow Analyzer?
ManageEngine's product has some performance issues. It runs very slowly when the system is large and does not support high availability for big flow and high-level operations. The product needs imp...
What is your primary use case for ManageEngine NetFlow Analyzer?
I use ManageEngine NetFlow Analyzer for detecting the root cause when the database and application run very slow. I have not yet used the traffic shaping feature of ManageEngine NetFlow Analyzer.
Ask a question
Earn 20 points
 

Also Known As

No data available
RSA ECAT, NetWitness Network
 

Overview

 

Sample Customers

Metro Rail, Micron21, Lotus F1 Team, Elizabeth Board of Education, Queen’s University Belfast, DHL, Praxair, Adventist Health, Wipro Infotech, Tropical Shipping USA
ADP, Ameritas, Partners Healthcare
Find out what your peers are saying about Auvik, NetAlly, Wireshark and others in Network Troubleshooting. Updated: October 2025.
869,952 professionals have used our research since 2012.