Try our new research platform with insights from 80,000+ expert users

NetWitness NDR vs ThreatBook Threat Intelligence Platform (TIP) comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 4, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness NDR
Ranking in Threat Intelligence Platforms (TIP)
40th
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (55th), Endpoint Detection and Response (EDR) (57th), Security Orchestration Automation and Response (SOAR) (25th), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (38th)
ThreatBook Threat Intellige...
Ranking in Threat Intelligence Platforms (TIP)
13th
Average Rating
9.6
Reviews Sentiment
7.6
Number of Reviews
4
Ranking in other categories
No ranking in other categories
 

Featured Reviews

reviewer1799727 - PeerSpot reviewer
Manager, IT Security Operations at a non-profit with 11-50 employees
Reliable and good support but can be expensive
I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to not only rely on the intelligence of the engineer in charge but to have some threat intelligence and some seeds of IOCs and to have the host have some artificial intelligence to reduce the number of false positives. I don't see this solution being very scalable. The solution is pricey.
RG
Security Technician at ZhongTianKeJi
Enhancement in incident response through reduced false positives and contextual intelligence
ThreatBook has positively impacted our organization by allowing us to detect all alerts and threats effectively. In the past, we needed to search logs from various sources, including terminals, DI servers, and firewalls, collecting a lot of logs and searching the internet for contextual information about threat actors. After using ThreatBook TDP, all alerts and contexts are easily displayed on the dashboard, making it very helpful for us. During the incident response scenario, ThreatBook saves us over 80% of the time for each incident. We usually took about one day or two days for attribution and understanding how the attacker attacked us, but after using ThreatBook TDP, we usually take around one or two hours to finish all these tasks. Additionally, their AI techniques save a lot of time, allowing me to ask in natural language for explanations about the meaning and target of the attacker.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."
"It is very easy to use, and its usability is great. The use cases are also very easy. The visualizations of the use cases are magnificent. You cannot find this in any other solution. From my point of view, it is great."
"The log correlation is good."
"The interface of this solution is very flexible and easy to use."
"Ability to isolate the machine when there are malicious files."
"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."
"This solution allows us to locate the malware in real-time."
"Technical support is knowledgeable."
"We have not suffered from any attack for the past few months, which has relatively improved our network security."
"ThreatBook saves us over 80% of time for each incident, reducing the usual time taken from one or two days for attribution to just one or two hours, thanks to their AI techniques."
"ThreatBook Threat Intelligence Platform (TIP) has positively impacted our organization by helping us generate the strategic threat focus reports and aiding us in decision-making, leading to improved cybersecurity operation efficiency."
"ThreatBook saves us over 80% of the time for each incident."
 

Cons

"The deployment process is complex. I don't know why, but this solution will suddenly stop working. Logs stop coming. Often, one thing or another stops working. Most of the time, one of my team members is working with troubleshooting and working with technical support. Log passing is also one of the biggest challenge."
"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"The solution lacks a reporting engine."
"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."
"The threat intelligence could improve in RSA NetWitness Endpoint."
"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."
"This solution needs an upgrade in reporting. I have heard from RSA that they are working on this, but as of yet it is not available."
"ThreatBook Threat Intelligence Platform (TIP) could be improved by providing more integrations to support additional platforms."
"It would be great if ThreatBook could integrate with our ITSM system to streamline the tasks and incident management"
"We’ve seen strong ROI through reduced incident response times, increased threat visibility, and less time wasted on false positives."
"I hope that ThreatBook can integrate a feature where if I detect any internal compromised hosts, I can block or isolate those compromised hosts within my internal network; that would be good."
 

Pricing and Cost Advice

"It is highly scalable. It can be bought based on your requirements."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"I do not have any opinion on the pricing or licensing of the product."
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"It is an expensive product."
"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."
"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."
"We are on a three-year contract to use RSA NetWitness Network."
Information not available
report
Use our free recommendation engine to learn which Threat Intelligence Platforms (TIP) solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
10%
Computer Software Company
10%
Manufacturing Company
9%
Performing Arts
7%
Recreational Facilities/Services Company
40%
Financial Services Firm
14%
Real Estate/Law Firm
6%
Performing Arts
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business10
Midsize Enterprise2
Large Enterprise5
No data available
 

Questions from the Community

Ask a question
Earn 20 points
What is your experience regarding pricing and costs for ThreatBook?
My experience with pricing, setup cost, and licensing is that it is cost-effective and the price is reasonable, with very good overall value and quality.
What needs improvement with ThreatBook?
I hope that ThreatBook can integrate a feature where if I detect any internal compromised hosts, I can block or isolate those compromised hosts within my internal network; that would be good. I wou...
What is your primary use case for ThreatBook?
We use ThreatBook to have overview visibility of all our assets including if there are any compromised hosts or if there are any incoming attacks from external threats. When we first deployed Threa...
 

Also Known As

RSA ECAT, NetWitness Network
No data available
 

Overview

 

Sample Customers

ADP, Ameritas, Partners Healthcare
Information Not Available
Find out what your peers are saying about NetWitness NDR vs. ThreatBook Threat Intelligence Platform (TIP) and other solutions. Updated: December 2025.
881,082 professionals have used our research since 2012.