No more typing reviews! Try our Samantha, our new voice AI agent.

NETSCOUT Arbor DDoS Protection & Mitigation vs NetWitness Platform comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NETSCOUT Arbor DDoS Protect...
Average Rating
8.8
Reviews Sentiment
6.9
Number of Reviews
57
Ranking in other categories
Distributed Denial-of-Service (DDoS) Protection (4th)
NetWitness Platform
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Log Management (36th), Security Information and Event Management (SIEM) (35th)
 

Mindshare comparison

NETSCOUT Arbor DDoS Protection & Mitigation and NetWitness Platform aren’t in the same category and serve different purposes. NETSCOUT Arbor DDoS Protection & Mitigation is designed for Distributed Denial-of-Service (DDoS) Protection and holds a mindshare of 5.5%, down 11.4% compared to last year.
NetWitness Platform, on the other hand, focuses on Log Management, holds 1.2% mindshare, up 0.4% since last year.
Distributed Denial-of-Service (DDoS) Protection Mindshare Distribution
ProductMindshare (%)
Arbor DDoS5.5%
Cloudflare11.7%
Imperva Application Security Platform7.6%
Other75.2%
Distributed Denial-of-Service (DDoS) Protection
Log Management Mindshare Distribution
ProductMindshare (%)
NetWitness Platform1.2%
Splunk Enterprise Security7.1%
IBM Security QRadar4.5%
Other87.2%
Log Management
 

Featured Reviews

reviewer1331304 - PeerSpot reviewer
Director Of Research And Development at a comms service provider with 11-50 employees
Automated threat intelligence and flow-based mitigation have improved our DDoS defense
A very useful feature in Arbor DDoS is its ability to send flow spec announcements to routers. For example, if it is clear that a Layer 3 or Layer 4 attack is occurring and the attack pattern is identified through source and destination IP addresses and ports, you can generate flow spec filters. These filters are transferred through BGP to border routers, which automatically build filters, mitigating the attack even at the network's boundary and preventing it from reaching the TMS. This allows the TMS to focus on other tasks. This is a highly effective feature that can mitigate huge volumetric attacks; for example, we experienced a 32-gigabit attack, and all those 32 gigabits were dropped by our border routers, not by Arbor DDoS itself. The flow spec announcement was generated by Arbor DDoS, and as far as I know, the same technology is used by Radware, but it comes under a different feature and a different license. At the time, we were told that flow spec mitigation was an additional very expensive license to purchase from Radware, while Radware included everything in one package.
reviewer1130436 - PeerSpot reviewer
Information Technology Security and Infrastructure Expert at a government with 201-500 employees
Helps to deal with potential attacks and is available at a reasonable price
My company has had many benefits from the use of the product in the last eight years. The tool has streamlined our company's incident response process since it serves as a log repository, which allows us to correlate events and access different technology stacks. In our company, we were able to actually find some potential attacks, so it has been very helpful. The tool's integration capability isn't so great. In my company, we managed to integrate it with our Microsoft Azure Subscription, after which we managed to integrate it with other tools. You will face a lot of difficulties if you want to integrate it with your database monitoring tool, PAM solutions, or IAM products. The product has done well overall for my company's teams to deal with their workflow efficiency. I would not recommend the product to others. I rate the tool a seven out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The technical support of Arbor DDoS is good."
"Arbor DDoS is used for network protection if you have a DDoS attack, it keeps the session or information moving."
"I highly recommend Arbor DDoS to others."
"The most valuable features include the traffic categorization and control of the traffic. The filtering of the traffic is very precise. When you want to stop some traffic, you precisely stop that traffic."
"In the seven years we have been using the tool, we have continued with availability of services as before, but today, without the Arbor solution, I believe we would have suffered quite a number of service availability issues."
"The auto-mitigation, that signaling feature, where it automatically raises an alarm that a line is under attack, is important. The upstream service provider will then do something to reduce the load on our internet lines. The fact that it's automated means I don't have to sit and always be looking at threats coming through. It does it almost automatically, without any intervention by me."
"When there was an attack, the attack was contained only on the IPs under attack, the rest of the network was not impacted, and that is the most important part."
"It prevents all unwanted or malicious traffic, using the Threat Intelligence feeds."
"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."
"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."
"The product's initial setup phase was not at all difficult."
"The development of use cases on the SSA console is quite user friendly, which means that the security analyst or the researcher does not have to learn another language."
"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."
"It gives customers visibility about their most important servers and devices."
"Offers a good wireless feature."
"Overall, this is a good solution with suitable features and it very well fits our needs."
 

Cons

"The following areas need improvement: opening and tracking support tickets, online support resources, software upgrades/updates and replacement media, and event management guidelines."
"The look and feel of the management console is a little old, excessively simple. If you compare it with other solutions, the look and feel of the console is like you're using technology from five or six years ago. It doesn't show all the technology that is actually behind it. It looks like an older solution, even though it is not."
"Because we had some routers that were somewhat old, they were not integrated with Arbor. They did not support the NetFlow version that Arbor was running. That was a challenge. We had to upgrade the routers. Some backward-compatibility would be helpful."
"Real-case scenarios that have taken too long to resolve or were escalated can be directly converted into articles."
"Support in Argentina is not so good. Although the team is good, they are not fast, and they lack the skills to manage dynamic attackers."
"As long as you don't touch it, it's very stable. But if you try to configure new features or some new deployment, sometimes that can be a problem."
"An issue which needs to be addressed concerns information I received of attacks on the radar and Arbor, allegedly, not taking any action."
"They also have limited sizes of the boxes. Different sizes are needed because some customers are very small while others are very big, such as ISPs, so this categorization should be available."
"RSA NetWitness Logs and Packets is far behind the competition."
"Its technical support could be better."
"Health monitoring of the event sources and devices."
"They should implement algorithms to digest that data and produce additional, more advanced reporting, alerting and support of internal security teams."
"Security needs improvement. We would still like to know how the traffic is entering the organization."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
"The initial setup is complex. There are other solutions that are easier to implement."
"The product's licensing models are complex to understand. This particular area needs improvement."
 

Pricing and Cost Advice

"Arbor's products are very expensive. Their competitors are cheap when compared with Arbor."
"Because the solutions from competitors are very different, it's not easy to compare. However, the licensing from Arbor is clear and understandable and the pricing is reasonable when looking at the market, in general."
"Arbor DDoS is quite expensive, but all these solutions are expensive because they deal with confidential information."
"I don't deal with the pricing, but it seems that you need to get basic support in order to upgrade the software and implement some patches."
"The solution is a bit costly if you're a small organization, but I think it's worth the price that they are charging."
"I'm a technical guy. But I know it's expensive compared to its competitors. After you have the on-premise solution, for your solution to be effective you have to subscribe to an "upper level," so there's another cost. There is also a subscription to cloud services, which is another cost."
"Arbor is striking a good balance between pricing and what they deliver."
"Start with a small license. Measure your bandwidth requirements."
"Our license is for one year."
"It’s cheaper to run virtual machines in a VMware environment."
"It is cheap."
"The product is expensive."
"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"The product price was reasonable for my region and the market."
report
Use our free recommendation engine to learn which Distributed Denial-of-Service (DDoS) Protection solutions are best for your needs.
916,240 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
16%
Outsourcing Company
11%
Comms Service Provider
8%
Construction Company
7%
Construction Company
12%
Financial Services Firm
12%
Comms Service Provider
10%
Outsourcing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business26
Midsize Enterprise14
Large Enterprise29
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
I would say if it’s an ISP that will build a scrubbing center, Netscout/Arbor is a good solution. In all other solutions, Imperva is a great choice.
Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Arbor would be the best bid, apart from Arbor, Palo Alto and Fortinet have good solutions. As this is an ISP, I would prefer Arbor.
What is your experience regarding pricing and costs for Arbor DDoS?
The prices for Arbor DDoS are expensive. The licensing is subscription-based. From our sales department, they discuss that prices are very high.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

Arbor Networks SP, Arbor Networks TMS, Arbor Cloud for ENT
RSA Security Analytics
 

Overview

 

Sample Customers

Xtel Communications
Los Angeles World Airports, Reply
Find out what your peers are saying about Radware, Cloudflare, Imperva and others in Distributed Denial-of-Service (DDoS) Protection. Updated: October 2026.
916,240 professionals have used our research since 2012.