Try our new research platform with insights from 80,000+ expert users

NetWitness NDR vs Splunk SOAR comparison

NetWitness and Splunk are both solutions in the Security Orchestration Automation and Response (SOAR) category. NetWitness is ranked #25, while Splunk is ranked #3 with an average rating of 8.0. NetWitness holds a 0.6% mindshare in SOAR, compared to Splunk’s 7.4% mindshare. Additionally, 87% of NetWitness users are willing to recommend the solution, compared to 86% of Splunk users who would recommend it.
NetWitness NDR
Read 15 NetWitness NDR reviews
  • 200 Views
  • 59 Comparison Views
87% willing to recommend
Splunk SOAR
Read 45 Splunk SOAR reviews
  • 4,185 Views
  • 1,586 Comparison Views
86% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Dec 5, 2024

NetWitness NDR and Splunk SOAR are two network security products competing in the domain of network detection and response. Splunk SOAR holds an advantage due to its advanced integration capabilities, appealing to businesses focused on automation and streamlined incident management.

Features: NetWitness NDR specializes in network monitoring, rich threat intelligence, automated threat detection, and deep packet inspection. Splunk SOAR offers automation and orchestration with seamless integration to third-party apps and playbook-driven responses, making it appealing for businesses seeking comprehensive security solutions.

Room for Improvement: NetWitness NDR could enhance its automation capabilities, expand its threat intelligence sources, and simplify interface customization. Splunk SOAR could benefit from reducing setup complexity, improving initial user experience, and refining its documentation to better support non-technical users.

Ease of Deployment and Customer Service: NetWitness NDR's deployment is straightforward with robust customer service to assist with setup. Splunk SOAR provides flexible implementation but may require more initial effort, although it allows integration with existing systems efficiently.

Pricing and ROI: NetWitness NDR offers moderate setup costs and favorable ROI from its detection capabilities, though initial expenses are notable. Splunk SOAR demands a higher initial investment but offers significant ROI in the long term through reduced manual intervention and enhanced automation capabilities, making it a worthwhile investment.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed NetWitness NDR vs. Splunk SOAR Report (Updated: June 2025).
Buyer's Guide
NetWitness NDR vs. Splunk SOAR
June 2025
Download the complete report
Helped 859,129 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
8.0
Implementing NetWitness NDR enhances security, improves network visibility, reduces costs, and boosts efficiency and productivity for businesses.
Sentiment score
6.6
Adoption of Splunk SOAR varied, with customization enhancing benefits; successful integration linked to experience, despite initial challenges.
 

Customer Service

Sentiment score
7.3
NetWitness NDR's customer service is generally efficient and highly regarded, though some users report occasional slow response times.
Sentiment score
7.2
Splunk SOAR support is generally responsive, yet telecom and IoT cases may face delays; community offers quicker resolutions.
No quotes available
For more quotes and insights, download the NetWitness NDR report
Splunk's technical support is very good and generally not needed often due to the stable environment.
For more quotes and insights, download the Splunk SOAR report
 

Scalability Issues

Sentiment score
7.0
NetWitness NDR is scalable for large enterprises, though some users report issues with scalability and agent migration.
Sentiment score
7.1
Splunk SOAR is highly scalable and flexible, though some users encounter minor challenges, mainly linked to internal management.
 

Stability Issues

Sentiment score
7.7
NetWitness NDR is generally reliable, providing real-time data and stability, though minor technical issues are occasionally reported.
Sentiment score
7.5
Splunk SOAR is stable, reliable, with minimal downtime and effective version control, despite occasional external vendor issues.
No quotes available
For more quotes and insights, download the NetWitness NDR report
Splunk SOAR provides a stable environment and technology.
For more quotes and insights, download the Splunk SOAR report
 

Room For Improvement

NetWitness NDR requires improvements in UI, scalability, detectability, integration, session times, pricing, training, and features, making it complex and slow.
Splunk SOAR users desire better integration, user interface, documentation, and features like automation, debugging, and reporting for improved operations.
No quotes available
For more quotes and insights, download the NetWitness NDR report
Although it enhances alert handling, it still has a journey to compete with Palo Alto SOAR and FortiSOAR.
To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced lifecycle management.
For more quotes and insights, download the Splunk SOAR report
 

Setup Cost

Splunk SOAR's pricing is consumption-based, often deemed expensive, with costs varying by data volume and region, impacting smaller organizations.
No quotes available
For more quotes and insights, download the NetWitness NDR report
Splunk SOAR is moderately priced, neither cheap nor overly expensive.
Splunk SOAR is affordable cost-wise only.
For more quotes and insights, download the Splunk SOAR report
 

Valuable Features

NetWitness NDR offers high detection rates, real-time malware response, third-party integration, and a user-friendly, interoperable interface with advanced analytics.
Splunk SOAR enhances threat response with automation, integration, customization, and user-friendly features, streamlining workflows and reducing manual tasks.
No quotes available
For more quotes and insights, download the NetWitness NDR report
Creating playbooks using the Playbook Editor in Splunk SOAR is easy. The editor is designed to be user-friendly with visual drag and drop features, allowing for easy workflows without writing any code.
The stable environment and the community provide strong support, reducing the need for technical support.
For more quotes and insights, download the Splunk SOAR report
 

Categories and Ranking

NetWitness NDR
Ranking in Security Orchestration Automation and Response (SOAR)
25th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (59th), Threat Intelligence Platforms (39th), Endpoint Detection and Response (EDR) (60th), Network Detection and Response (NDR) (21st), Extended Detection and Response (XDR) (38th)
Splunk SOAR
Ranking in Security Orchestration Automation and Response (SOAR)
3rd
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
45
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of June 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of NetWitness NDR is 0.6%, up from 0.4% compared to the previous year. The mindshare of Splunk SOAR is 7.4%, down from 8.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Orchestration Automation and Response (SOAR)
 

Featured Reviews

SupravatMaji - PeerSpot reviewer
Beneficial single unified dashboard, good native application integration, and high availability
My advice to those wanting to implement RSA NetWitness Network is they have to first do a little due diligence, such as the exact requirement based on their needs. That will give them a direction for their investment because otherwise, the bill of material or bill of quantity (BOQ) may be higher side. It is important to do good due intelligence on the environment, see the exact requirement, and then go ahead with the solution. The solution is perfectly stable. I rate RSA NetWitness Network a nine out of ten.
Read full review
SAURABHYADAV4 - PeerSpot reviewer
Enables optimization by reducing manual intervention and increasing automation in the workflow
The product provides 100% automation for certain processes. It needs no manual intervention. We can integrate various tools like VirusTotal and ServiceNow. We can automate all the tasks. It is one of the best things about the tool. It also provides workforce protection. Whenever we get any alerts or make any configurations, we develop workflow automation using the playbooks. We can fully automate some of the security incident resolutions. We can also do identification and redirection using the product. I have integrated Splunk Phantom with Splunk Cloud. Previously, I used it with Splunk on-premise to get the logs into Splunk for tracking and audit purposes. Since Splunk is a SaaS-based product, it has certain maintenance windows. Over time, the vendor does some maintenance during off-production hours. Creating playbooks using the solution’s playbook editor is not tough. For someone who knows the solution, I rate the ease of creating playbooks as four out of five. The solution’s playbook viewer provides full visibility. The product provides different integrations. We can easily integrate the tool with VirusTotal, ServiceNow, and the asset and identity management system. The product is somewhat easier to use in an investigation. We have been able to identify the false positives using the product. The tool has helped reduce false positives by 30%. Splunk SOAR has helped reduce our mean time to detect by 10% to 15%. Splunk SOAR has a major impact on our meantime to resolve. Our mean time to resolve has been reduced by 35% to 40%. I have integrated VirusTotal with Splunk SOAR. Instead of doing manual checks, I can easily get the score by integrating the tool with Splunk SOAR. I have also synced Active Directory with the asset and identity management system. It's been a long time since we have implemented Splunk SOAR. It brings value to our organization. Before Splunk SOAR, everything was done using manual intervention. We had to educate the SOC team on how to do tasks. We also had to create playbooks for them. With Splunk SOAR, we only have to educate the team about how things are done so that they can perform a manual intervention when there is a failure, which is rare. After deploying the product, we had to provide some training to the SOC team. After getting trained, it was hands-on. Along with other Splunk solutions, Splunk SOAR provides the resilience to face any issues and hardships. We easily cope with downtimes. Splunk SOAR offers us end-to-end visibility across our environment. It depends on how much we utilize it. Visualizing and troubleshooting our cloud-native environment using Splunk SOAR is somewhat easy. I have to coordinate with the Phantom administrators if there is any issue. I work mostly on playbook development and integrating it with security instances.
Read full review
report
See which vendors are best for you
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
See recommendations
859,129 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
16%
Government
9%
Manufacturing Company
9%
Computer Software Company
14%
Financial Services Firm
12%
Manufacturing Company
11%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Ask a question
Earn 20 points
What do you like most about Splunk Phantom?
Splunk SOAR's quick response to incidents is the most valuable part.
See all answers
What is your experience regarding pricing and costs for Splunk Phantom?
Splunk SOAR is moderately priced, neither cheap nor overly expensive.
See all answers
What needs improvement with Splunk Phantom?
There are areas in Splunk SOAR that have room for improvement. To make Splunk SOAR a better solution, there could be better built-in debugging tools, smarter playbook suggestions, and enhanced life...
See all answers
 

Comparisons

Darktrace vs NetWitness NDR Logo
Darktrace vs NetWitness NDR
Compared 13% of the time
Fidelis Elevate vs NetWitness NDR Logo
Fidelis Elevate vs NetWitness NDR
Compared 11% of the time
Cortex XDR by Palo Alto Networks vs NetWitness NDR Logo
Cortex XDR by Palo Alto Networks vs NetWitness NDR
Compared 8% of the time
Vectra AI vs NetWitness NDR Logo
Vectra AI vs NetWitness NDR
Compared 8% of the time
ExtraHop Reveal(x) vs NetWitness NDR Logo
ExtraHop Reveal(x) vs NetWitness NDR
Compared 7% of the time
More NetWitness NDR Competitors
Palo Alto Networks Cortex XSOAR vs Splunk SOAR Logo
Palo Alto Networks Cortex XSOAR vs Splunk SOAR
Compared 18% of the time
Cortex XSIAM vs Splunk SOAR Logo
Cortex XSIAM vs Splunk SOAR
Compared 17% of the time
Fortinet FortiSOAR vs Splunk SOAR Logo
Fortinet FortiSOAR vs Splunk SOAR
Compared 11% of the time
Tines vs Splunk SOAR Logo
Tines vs Splunk SOAR
Compared 9% of the time
ServiceNow Security Operations vs Splunk SOAR Logo
ServiceNow Security Operations vs Splunk SOAR
Compared 9% of the time
More Splunk SOAR Competitors
 

Product Reports

Buyer's Guide
NetWitness NDR
June 2025
NetWitness NDR reportDownload NetWitness NDR product report
Buyer's Guide
Splunk SOAR
May 2025
Splunk SOAR reportDownload Splunk SOAR product report
 

Also Known As

RSA ECAT, NetWitness Network
Phantom
 

Overview

Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.

NetWitness

Splunk SOAR offers features like automation and orchestration of manual tasks, speeding up work, detection and response to advanced and emerging threats. 

Go from overwhelmed to in-control

Automate manual tasks. Address every alert, every day. Establish repeatable procedures that allow security analysts to stop being reactive and focus on mission-critical objectives to protect your business.

Force multiply your team

Orchestrate and automate repetitive tasks, investigation and response to increase efficiency and productivity, and do more with the people you already have. Make a team of three feel like a team of 10.

From 30 minutes to 30 seconds

Work faster with Splunk SOAR. Respond to threats in seconds. Lower your mean time to respond (MTTR) by automating security tasks and workflows across all of your security tools.

End-to-end security operations made easy

Take advantage of Splunk Enterprise Security and Splunk SOAR joining forces to provide a seamless and intuitive SecOps platform to prevent, detect and respond to advanced and emerging threats.

Splunk
 

Sample Customers

ADP, Ameritas, Partners Healthcare
Recorded Future, Blackstone
Buyer's Guide
NetWitness NDR vs. Splunk SOAR
June 2025
Free Report: NetWitness NDR vs. Splunk SOAR
Find out what your peers are saying about NetWitness NDR vs. Splunk SOAR and other solutions. Updated: June 2025.
DOWNLOAD NOW
859,129 professionals have used our research since 2012.
See our NetWitness NDR vs. Splunk SOAR report.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.