Try our new research platform with insights from 80,000+ expert users

NetWitness NDR vs ThreatBook comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 31, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness NDR
Ranking in Threat Intelligence Platforms
39th
Ranking in Network Detection and Response (NDR)
21st
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (59th), Endpoint Detection and Response (EDR) (60th), Security Orchestration Automation and Response (SOAR) (25th), Extended Detection and Response (XDR) (38th)
ThreatBook
Ranking in Threat Intelligence Platforms
16th
Ranking in Network Detection and Response (NDR)
14th
Average Rating
9.6
Reviews Sentiment
7.5
Number of Reviews
2
Ranking in other categories
No ranking in other categories
 

Featured Reviews

SupravatMaji - PeerSpot reviewer
Beneficial single unified dashboard, good native application integration, and high availability
My advice to those wanting to implement RSA NetWitness Network is they have to first do a little due diligence, such as the exact requirement based on their needs. That will give them a direction for their investment because otherwise, the bill of material or bill of quantity (BOQ) may be higher side. It is important to do good due intelligence on the environment, see the exact requirement, and then go ahead with the solution. The solution is perfectly stable. I rate RSA NetWitness Network a nine out of ten.
RG
Enhancement in incident response through reduced false positives and contextual intelligence
ThreatBook has positively impacted our organization by allowing us to detect all alerts and threats effectively. In the past, we needed to search logs from various sources, including terminals, DI servers, and firewalls, collecting a lot of logs and searching the internet for contextual information about threat actors. After using ThreatBook TDP, all alerts and contexts are easily displayed on the dashboard, making it very helpful for us. During the incident response scenario, ThreatBook saves us over 80% of the time for each incident. We usually took about one day or two days for attribution and understanding how the attacker attacked us, but after using ThreatBook TDP, we usually take around one or two hours to finish all these tasks. Additionally, their AI techniques save a lot of time, allowing me to ask in natural language for explanations about the meaning and target of the attacker.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature is the way it captures the traffic, and it contains every detail of the communication."
"The stability of the RSA NetWitness Endpoint is very good."
"The interface of this solution is very flexible and easy to use."
"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."
"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."
"We've contacted technical support several times. They've been very good. They have been able to help us resolve our issues."
"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."
"It is very easy to use, and its usability is great. The use cases are also very easy. The visualizations of the use cases are magnificent. You cannot find this in any other solution. From my point of view, it is great."
"ThreatBook saves us over 80% of time for each incident, reducing the usual time taken from one or two days for attribution to just one or two hours, thanks to their AI techniques."
"ThreatBook saves us over 80% of the time for each incident."
 

Cons

"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."
"RSA NetWitness Network could improve on integration with non-native application integration."
"The integration of the solution needs to be improved. The dashboard needs lots of updates as well. In the next release, we would like to see advanced fraud detection features."
"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."
"Threat detection could be better."
"The solution lacks a reporting engine."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"It would be great if ThreatBook could integrate with our ITSM system to streamline the tasks and incident management"
"We’ve seen strong ROI through reduced incident response times, increased threat visibility, and less time wasted on false positives."
 

Pricing and Cost Advice

"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"I do not have any opinion on the pricing or licensing of the product."
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"It is highly scalable. It can be bought based on your requirements."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"We are on a three-year contract to use RSA NetWitness Network."
"It is an expensive product."
Information not available
report
Use our free recommendation engine to learn which Threat Intelligence Platforms solutions are best for your needs.
857,162 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
16%
Government
9%
Manufacturing Company
9%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for ThreatBook?
The procurement process is easy because ThreatBook is a subscription model, and when I need it, I just pay for it. The billing experience is clear with no extra fees; all the costs are clearly show...
What needs improvement with ThreatBook?
It would be great if ThreatBook could integrate with our ITSM system to streamline the tasks and incident management, and I hope this feature will be provided in the future. Everything is perfect, ...
What is your primary use case for ThreatBook?
Mainly, we use ThreatBook TDP to monitor the east-west and north-south network traffic, detect abnormal behaviors, and provide contextual intelligence to support our threat hunting and incident res...
 

Comparisons

 

Also Known As

RSA ECAT, NetWitness Network
No data available
 

Overview

 

Sample Customers

ADP, Ameritas, Partners Healthcare
Information Not Available
Find out what your peers are saying about NetWitness NDR vs. ThreatBook and other solutions. Updated: June 2025.
857,162 professionals have used our research since 2012.