Try our new research platform with insights from 80,000+ expert users

NetWitness Platform vs VMware Aria Operations for Logs comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness Platform
Ranking in Log Management
33rd
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
37
Ranking in other categories
Security Information and Event Management (SIEM) (30th)
VMware Aria Operations for ...
Ranking in Log Management
12th
Average Rating
8.2
Reviews Sentiment
6.4
Number of Reviews
28
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of October 2025, in the Log Management category, the mindshare of NetWitness Platform is 0.4%, up from 0.3% compared to the previous year. The mindshare of VMware Aria Operations for Logs is 1.4%, up from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Market Share Distribution
ProductMarket Share (%)
VMware Aria Operations for Logs1.4%
NetWitness Platform0.4%
Other98.2%
Log Management
 

Featured Reviews

MOTASHIM Al Razi - PeerSpot reviewer
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.
LarsChristensen - PeerSpot reviewer
Efficient troubleshooting with precise log filtering and an easy setup
The tool could benefit from improved filter settings and dashboarding. While there are dashboards available, they are often created by community members and may not work after updates. It would be beneficial to have a roadmap for these dashboards to ensure consistent functionality. It would also be advantageous if the tool could process even large amounts of data faster, though this may be more related to data movement challenges rather than the software itself.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It gives the ability to investigate into network traffic in the Net and the organization what we couldn't do before."
"NetWitness can be highly beneficial for incident detection and response."
"It gives the capability for the incident response team to correlate logs to identify any kind of problem like malware and incidents in a general sense, both for logs and packets."
"The most valuable features are the packet inspection and the automated incident response."
"The development of use cases on the SSA console is quite user friendly. This means that the security analyst or the researcher does not have to learn another language."
"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."
"In my opinion, the solution's most valuable feature is its capacity to monitor network traffic, logs from devices within the network, and network captures. This capability extends beyond logs to include full network capturing."
"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."
"The root cause analysis feature is very valuable."
"I like the interface."
"The ability to narrow into a specific time to filter heavy hitters and anomalies is extremely valuable."
"It is very scalable and can handle a large workload."
"The most valuable features are log centralization and long-term retention for logs."
"The solution is quite user-friendly."
"The solution's simplicity, flexibility, and extensibility are valuable features as we can integrate everything in vRealize."
"The system's management and its alerts are the most valuable aspects of the solution."
 

Cons

"I believe that integrating the solution with other products such as Oracle would be beneficial."
"We have encountered issues with unresolved crashes."
"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."
"Its technical support could be better."
"The user interface is a little bit difficult for new users and it needs to be improved."
"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."
"The initial setup is complex. There are other solutions that are easier to implement."
"RSA NetWitness Logs and Packets can improve the threat level aspect, it is lacking compared to other solutions. Whenever any hacking activity or any other threat factor occurred they used to provide the coverages very fast when comparing RSA NetWitness Logs and Packets. I heard the other three solutions, from a discussion with my team members who had experience in other solutions, they used to say that. Whenever any issues happened across the globe RSA NetWitness Logs and Packets are a little bit slow improving those detection mechanisms."
"From an improvement perspective, the tool needs to be made more user-friendly."
"If data migration occurs during a search, it alters performance, causing delays."
"Integration with other vendors is something that could be improved, they could add more vendors."
"In vRealize login files, we have limitations regarding log partitions."
"In the VMware environment, one area for improvement is the handling of VM failovers due to host failures, such as unexpected shutdowns from hardware issues. Currently, High Availability (HA) doesn't seem to recognize whether the VMs are online during failover, treating them as offline or unavailable."
"The response time and quality need improvement. It takes too long to prove a problem and get a solution."
"The pricing of the solution could be improved."
"Paid or free does not matter, but it is complex to find good training material for vRealize Log Insight."
 

Pricing and Cost Advice

"The product is expensive."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"Our license is for one year."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
"I rate the product's price a six on a scale of one to ten, where one is cheap, and ten is expensive."
"The licensing cost for vRealize Log Insight is a little higher, so in terms of cost, it all depends upon what kind of environment you have. If you have a complete virtualized environment, or at least you're using a ninety-five percent virtualized environment, then vRealize Log Insight will play a very good role because it is a VMware component, so it has very tight integration with other VMware components and systems. This means you don't have to procure any other monitoring and management tool, and you don't need a separate automation tool. vRealize Log Insight will have an upper hand if your environment is purely virtualized on VMware. If you're using a mix of physical and virtual components, for example, a 50:50 ratio, then you need to have a third-party component to manage overall monitoring."
"It is not cheap. But it is worth it."
"Pricing could always be lower. If it were free, I would be more satisfied."
"I am not sure what the exact cost is. However, I believe the vRealize suite costs $2,500.00 per year."
"The product's price is reasonable, but when it comes to SQL licensing, it's a bit expensive."
"Pricing is good because it is part of the suite package. It comes in a bundle for us."
"The pricing has been updated recently."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
869,566 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Computer Software Company
12%
Comms Service Provider
7%
Performing Arts
7%
Government
12%
Financial Services Firm
12%
Computer Software Company
12%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise7
Large Enterprise20
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise9
Large Enterprise12
 

Questions from the Community

What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What do you like most about vRealize Log Insight?
The events are notably more descriptive, aiding in security and event analysis. We've also integrated Sky Collector, providing valuable insights and solutions for troubleshooting.
What is your experience regarding pricing and costs for vRealize Log Insight?
The cost of using VMware Aria Operations for Logs was very high, around two to three million dollars, although the exact figure is uncertain. The price was proving to be too much, especially with t...
What needs improvement with vRealize Log Insight?
VMware Aria Operations for Logs is not a cost-effective tool. Changing any telemetry requires creating a new template, such as changes to the VM disk size. Always having to create a new template ma...
 

Also Known As

RSA Security Analytics
vRealize Log Insight
 

Overview

 

Sample Customers

Los Angeles World Airports, Reply
Wildlands Adventure Zoo, Medic Mobile, IBM, Seventy Seven Energy, Baystate Health, Osis, Oxford University, Columbia University, Siemens, Cardinal Health, Ashdod Port, Vasakronan, Sydney Adventist Hospital, University of Derby
Find out what your peers are saying about NetWitness Platform vs. VMware Aria Operations for Logs and other solutions. Updated: September 2025.
869,566 professionals have used our research since 2012.