NetWitness Platform Reviews

Name: NetWitness Platform
Brand: NetWitness
Rating: 3.7 (37 reviews)

3.7 out of 5

37 reviews
75% willing to recommend

2,200 followers

What is NetWitness Platform?

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

Get the NetWitness Platform Buyer's Guide and find out what your peers are saying about NetWitness Platform, Splunk Enterprise Security, IBM Security QRadar and more!

NetWitness Platform is the #22 ranked solution in Log Management Software and top Security Information and Event Management (SIEM) solutions. PeerSpot users give NetWitness Platform an average rating of 7.4 out of 10. NetWitness Platform is most commonly compared to Splunk Enterprise Security: NetWitness Platform vs Splunk Enterprise Security. NetWitness Platform is popular among the large enterprise segment, accounting for 67% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 19% of all views.

Helped 849,686 peers since 2012

Featured NetWitness Platform reviews

MdZaman

IT manager at a agriculture with 10,001+ employees

The solution should have more integration capabilities with different platforms. The API is nearly open and scalable, so the solution can integrate with many platforms. The solution has more than 200 log sources in the scalability to support, but this is its limit. Installation is pretty easy. However, there are a couple of modules involved, so it is not as easy as it could be. We are talking about a distributed module, not a single-module type. This is what makes things a bit complex, instead of easier. I rate it as a seven out of ten on its installation and configuration capabilities.

Read full review

Sandeep Sehrawat

Information Technology Security Consultant at Sify Technologies

Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports. The complexity of the deployment depends on the amount and type of log sources. Are there any custom home-grown log sources for which you need to create the custom parsers? How many different logs or log lines in a home grown application? These factors might make your parser development a bit cumbersome.

Read full review

Hubert Luberek

Information Technology Security Architect at a financial services firm with 5,001-10,000 employees

The web interface needs improvement because right now they have problems combining an older interface with a newer interface. They're in the middle of the process of combining the old and the new one. It sometimes confuses the user and sometimes you are not able to find the necessary information. You need to click the information and that is something that should be improved. The data isn't a problem but you need to get used to it. You need to know where to click in order to get the results. Otherwise, you can encounter some problems. I would be very happy if they would fix all the issues from 11.3 to the 11.4 version to have more advantages from the UEBA because the UEBA we have implemented will be the longest. If they will fully integrate the UEBA with the network data, this could be a very huge advantage and impact on the market. Right now, you have a solution like Darktrace which has the same capabilities as RSA NetWitness so NetWitness should implement the same things. They have UEBA, they have data. They should implement algorithms to digest that data and produce additional, more advanced reporting, alerting and support of internal security teams.

Read full review

NetWitness Platform mindshare

Product category:

As of May 2025, the mindshare of NetWitness Platform in the Log Management category stands at 0.3%, down from 0.4% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Log Management

PeerResearch reports based on NetWitness Platform reviews

Type	Title	Date
Category	Log Management	Apr 30, 2025	Download
Product	Reviews, tips, and advice from real users	Apr 30, 2025	Download
Comparison	NetWitness Platform vs Wazuh	Apr 30, 2025	Download
Comparison	NetWitness Platform vs Splunk Enterprise Security	Apr 30, 2025	Download
Comparison	NetWitness Platform vs Datadog	Apr 30, 2025	Download

Title	Rating	Mindshare	Recommending
Splunk Enterprise Security	4.2	7.3%	93%	306 interviews Add to research
IBM Security QRadar	4.0	3.7%	91%	208 interviews Add to research

Valuable Features

NetWitness Platform offers features like real-time correlation, log ingestion, and full packet capture, enabling detailed network traffic analysis. Users appreciate its incident management, automated threat detection, and user-friendly interface. Its advanced capabilities allow creation of custom rules, integration with other tools, and detailed reporting. The platform's security intelligence and threat prediction enhance network forensics. Flexible deployment and efficient analytics are valued, as well as the ability to monitor network devices and data efficiently.

"NetWitness Platform offers flexibility for deployment and robust integration capabilities."
"NetWitness can be highly beneficial for incident detection and response."
"The product's initial setup phase was not at all difficult."

Room for Improvement

NetWitness Platform would benefit from improved integration with third-party tools, streamlined user interface, and better support for external tools like sandboxes. Enhanced threat detection and centralized management are desired. The setup is complex and the API needs refinement. Users experience challenges with log aggregation and reporting. Improved documentation and ease of use are needed. Additionally, features like machine learning, artificial intelligence, and automated incident responses are recommended. Better customization and reliable support are also sought.

"The product's licensing models are complex to understand. This particular area needs improvement."
"The tool's integration capability isn't so great."
"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."

ROI

NetWitness Platform has proven to be financially beneficial for users. Many have reported positive returns on investment, indicating that the platform has helped them achieve their desired outcomes.

Pricing

NetWitness Platform pricing varies widely based on deployment and usage, often rated as expensive but competitive for enterprise buyers. License structures include perpetual and annual models, factoring in EPS and data volume. Many find virtual machines cost-effective over hardware. Some recommend the full solution for better value. Designated support incurs additional costs. Recent pricing plans are seen as fair, appealing to diverse organizational sizes. Virtual machine adoption has reduced appliance-related expenses.

"It provides tools to assist in selecting the appropriate license and usage scenarios."
"The product price was reasonable for my region and the market."
"The product is expensive."

Popular Use Cases

NetWitness Platform is primarily used for network monitoring, threat detection, and security management. Enterprises employ it for log analysis, anomaly identification, and compliance. It supports monitoring across networks, endpoints, and databases. Organization use cases span malware detection, threat prediction, and SOC integrations. They leverage its capabilities for real-time alerts, forensic analysis, and incident management. Its deployment aids in security operations by providing insights from varied data sources, crucial for governance and incident responses.

Service and Support

Customer service for Enterprise Customers is highly rated, while technical support receives mixed feedback, ranging from fast responses but slow escalation to lacking expertise. Some rate it 8/10 for proficiency, while others find them frustrating due to delayed replies. Technical support is considered good, responsive, and professional, though there are challenges with responsibility and international support limitations. Ratings vary, with some users satisfied despite high costs, whereas others find improvement needed in expertise and response times.

Deployment

Initial setup experiences with NetWitness Platform are mixed. Some find it straightforward and quick to deploy, especially with expertise. Others report complexity, requiring professional support to manage integrations and configurations. Duration varies, ranging from two days to several months, influenced by organizational size and complexity. Ongoing maintenance can be demanding, needing skilled personnel and effective resource allocation. Opinions range from easy to intricate, depending on familiarity, environment, and the level of customizations needed.

Scalability

Users generally find NetWitness Platform to be highly scalable, accommodating small to large organizations. It efficiently handles increased capacity and user load. Network deployment is crucial, as metadata flows are significant. While licensing may influence limits, users can expand resources via cloud solutions. Enterprises appreciate its scalability, although specific implementations and hardware considerations might affect performance. Some users rate it below average for scalability due to on-premise hardware demands.

Stability

Users generally find NetWitness Platform stable with reliable performance when systems are properly configured with adequate CPU, RAM, and HDD. However, some note instability during updates and upgrades, particularly with versions prior to 11.3. Earlier versions had stability issues, but recent updates improved performance. A well-sized setup helps, though some users experienced crashes despite technical support. Stability ratings vary, often around seven to nine out of ten.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our NetWitness Platform Buyer's Guide for additional reliable information.