Try our new research platform with insights from 80,000+ expert users

NetWitness Platform vs Trellix ESM comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 18, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness Platform
Ranking in Security Information and Event Management (SIEM)
30th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Log Management (33rd)
Trellix ESM
Ranking in Security Information and Event Management (SIEM)
17th
Average Rating
7.4
Reviews Sentiment
7.0
Number of Reviews
38
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2025, in the Security Information and Event Management (SIEM) category, the mindshare of NetWitness Platform is 0.6%, up from 0.6% compared to the previous year. The mindshare of Trellix ESM is 1.1%, up from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM) Market Share Distribution
ProductMarket Share (%)
Trellix ESM1.1%
NetWitness Platform0.6%
Other98.3%
Security Information and Event Management (SIEM)
 

Featured Reviews

MOTASHIM Al Razi - PeerSpot reviewer
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.
Daniel Durian - PeerSpot reviewer
Helps to monitor and detect cyberattacks
The tool's effectiveness depends on how you define your log sources. To build visibility of incoming and outgoing traffic, you need logs from perimeter defense, firewalls, web application firewalls, and endpoint protection. With good traffic visibility, incident response time is really quick. Trellix ESM provides situation awareness. On the dashboard, I can see outbound and inbound communications to known threat hosts, IPS/IDS activity, and threat intelligence of the perimeter defense in the firewall. This information helps preempt attacks.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature is the hunting ability to work in a CERT."
"The most valuable feature is the correlation. It can report in real-time and monitor the management."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
"In my opinion, the solution's most valuable feature is its capacity to monitor network traffic, logs from devices within the network, and network captures. This capability extends beyond logs to include full network capturing."
"The most valuable features are the packet inspection and the automated incident response."
"The product has a user-friendly interface and a valuable feature for threat intelligence integration."
"The most valuable features are the threat prediction and network forensics."
"The most valuable features are the packet decoder, log decoder, and concentrator."
"The solution is 100% stable. We really have had a great time working with it. It hasn't let us down."
"McAfee as a whole is a good solution."
"It is easy to use and deploy. It comes with user-friendly manuals."
"It is user-friendly. The notification part of McAfee ESM is very easy."
"Trellix ESM is very user-friendly."
"It enables us to detect malicious threats, issues, or vulnerabilities in our network."
"The most valuable feature for us is that it comes with many correlations, reports, and dashboards already available. It's also very easy to use."
"It can be easily deployed with the other solutions."
 

Cons

"Its technical support could be better."
"I believe that integrating the solution with other products such as Oracle would be beneficial."
"The log system is a bit complex and has room for improvement."
"The implementation needs assistance."
"The multi-tenant capabilities are lagging compared to IBM QRadar."
"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."
"The user interface is a little bit difficult for new users and it needs to be improved."
"The solution should have more integration capabilities with different platforms."
"We would welcome integrations with some of the new McAfee acquisitions, e.g., behavioural analytics."
"I have to purchase a new box now. Its existing box is not scalable and I can't use it anymore."
"The initial setup is difficult and could improve."
"Tech support is required each time there is a system update of the solution."
"Product-wise, adding accounts on a single data source by batch would be a really great help."
"Areas of Trellix ESM that could be improved or enhanced include checking on the clients who are still on-prem, especially banks, as most are not moving everything to the cloud due to confidentiality and accessibility during network outages."
"Cloud integration has room for improvement because they're not full-fledged to integrate with the cloud solutions that come. They use different integration platforms to bring in data, and that needs to be improved."
"We cannot add new data sources to the most recent version."
 

Pricing and Cost Advice

"The product is expensive."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"Our license is for one year."
"We are on an annual license for the use of the solution."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"It is cheap."
"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."
"When compared to IBM Security QRadar and other similar platforms, the pricing of McAfee ESM is reasonable and comparatively less expensive."
"The licensing cost is based on EPS."
"It is an inexpensive product. We purchase its yearly license."
"The pricing is fair."
"The product is slightly expensive."
"Regarding pricing, Trellix ESM is not that expensive. It's less than half the cost of IBM QRadar."
"The pricing is good, and they are competitive compared to providers such as RSA and IBM QRadar."
"We pay for our licensing fees on a yearly basis, and there are no costs in addition to the standard licensing fees."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
872,019 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Computer Software Company
11%
Comms Service Provider
7%
Performing Arts
7%
Comms Service Provider
16%
Financial Services Firm
10%
Computer Software Company
8%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
By reviewers
Company SizeCount
Small Business15
Midsize Enterprise6
Large Enterprise24
 

Questions from the Community

What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What do you like most about McAfee ESM?
The solution's technical support is great.
What is your experience regarding pricing and costs for McAfee ESM?
When discussing Trellix ESM pricing and licensing, if you consider some premium product, the pricing also has to be premium, however, enterprise customers who look for a premium product, alongside ...
What needs improvement with McAfee ESM?
Areas of Trellix ESM that could be improved or enhanced include checking on the clients who are still on-prem, especially banks, as most are not moving everything to the cloud due to confidentialit...
 

Also Known As

RSA Security Analytics
McAfee ESM, NitroSecurity, McAfee Enterprise Security Manager
 

Overview

 

Sample Customers

Los Angeles World Airports, Reply
San Francisco Police Credit Union, Wªstenrot Gruppe, Volusion, California Department of Corrections & Rehabilitation, Government of New Brunswick, State of Colorado, Macquarie Telecom, Texas Tech University Health Sciences Center, Cologne Bonn Airport
Find out what your peers are saying about NetWitness Platform vs. Trellix ESM and other solutions. Updated: September 2025.
872,019 professionals have used our research since 2012.