RSA NetWitness Endpoint Reviews

We use the solution for the contamination. We detect the incidents and then proceed for the contamination and error notification. For example, there's some intrusion history to the endpoint and there's a partial command that detects the code imbalance. We're able to find it and deal with it.

The detection rate and tracking features including historical tracking, tracking of the fires on the desk, and tracking of the file last monitored are all quite valuable for us.

The contamination feature could be improved.

I've been using the solution for six years now.

The stability of the solution is good. I'd rate it seven out of ten overall. We've had minor technical issues.

The solution is highly scalable. Users just need to install the agent on the products. Right now, we have about 1,000 users. We use the solution daily.

We've contacted technical support several times. They've been very good. They have been able to help us resolve our issues.

We didn't previously use another solution.

The initial setup was pretty straightforward. We didn't run into any issues. I can't recall how long it took to deploy.

We had a professional service assist us with the initial setup.

We use the on-premises deployment model.

The contamination should be improved. If a new user needs better contamination capabilities, they should use something else.

I'd rate the solution seven out of ten. If it offered better triaging of incidents, I'd rate it higher.

We are using it as a SIEM tool. 

One of the most valuable features is the Orchestrator.

This solution needs an upgrade in reporting. I have heard from RSA that they are working on this, but as of yet it is not available.

It is stable. We have been using it for some time, without any issues.

I think it would scale nicely but we have not needed to expand our organizational needs yet.

The initial setup was not complex.

I do not have any opinion on the pricing or licensing of the product.

I used other solutions such as EnVision in the past.

It is mainly for market analysis. It has been performing exceedingly well.

It helps our security team respond more accurately when there are threats, then we get less false positives or negatives.

RSA NetWitness does market analysis in a more granular form. It gives you full visibility. You have good visibility across the flow of markets, then you can connect with more security devices across the network. 

The solution is modular, for example you can buy the RSA ePack, which you buy as a module is not part of the conduit solution. They could include it and have it as an all-in-one solution. However, customers understand the model, so they buy them in modules and put them together.

The stability is good. It does not fail.

It is highly scalable. It can be bought based on your requirements.

The product has excellent support.

The initial setup requires a high level of skill, then the setup is good and smooth. If you have the skill, then you will get through it easily.

The pricing is good. It is competitive. With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing. They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend.

I would highly recommend the solution. Just go ahead and get it. It is the best you can get.

We chose a solution of RSA endpoint protection because of the value proposition they offered. It became clear that they have the right solution for a serious enterprise and the security operation center (SOC), and they offered the right value.

It meets our major requirements and gives you peace of mind.