We changed our name from IT Central Station: Here's why

RSA NetWitness Network OverviewUNIXBusinessApplication

RSA NetWitness Network is #7 ranked solution in top Network Detection and Response (NDR) tools and #11 ranked solution in Network Traffic Analysis tools. PeerSpot users give RSA NetWitness Network an average rating of 8 out of 10. RSA NetWitness Network is most commonly compared to Darktrace: RSA NetWitness Network vs Darktrace. The top industry researching this solution are professionals from a computer software company, accounting for 25% of all views.
What is RSA NetWitness Network?

RSA NetWitness® Network exposes network data to enhance a security
team’s capabilities to detect and respond to today’s advanced threats. RSA
NetWitness Network provides immediate deep visibility for rapid detection,
efficient investigation and forensics, in order to reduce dwell time. With
unparalleled speed for real-time behavior analytics, RSA patented technology
accelerates detection and investigation of threats as they traverse your
network. RSA NetWitness Network provides real-time visibility into all your
network traffic—on premises, in the cloud and across virtual environments.
RSA NetWitness Network enables threat hunting with streamlined workflows
and integrated, automated investigation tools that analysts use to hunt
and monitor the timing and movements of threat actors. Through a unique
combination of behavioral analytics, data science techniques and threat
intelligence, RSA NetWitness Network detects known and unknown attacks
that put organizations at risk.

Buyer's Guide

Download the Network Traffic Analysis (NTA) Buyer's Guide including reviews and more. Updated: January 2022

RSA NetWitness Network Customers
Busan Bank, Banorte Bank, Eastern Bank
RSA NetWitness Network Video

RSA NetWitness Network Pricing Advice

What users are saying about RSA NetWitness Network pricing:
  • "The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."
  • "It is an expensive product."
  • RSA NetWitness Network Reviews

    Filter by:
    Filter Reviews
    Industry
    Loading...
    Filter Unavailable
    Company Size
    Loading...
    Filter Unavailable
    Job Level
    Loading...
    Filter Unavailable
    Rating
    Loading...
    Filter Unavailable
    Considered
    Loading...
    Filter Unavailable
    Order by:
    Loading...
    • Date
    • Highest Rating
    • Lowest Rating
    • Review Length
    Search:
    Showingreviews based on the current filters. Reset all filters
    Manager, Soc
    Real User
    Top 20
    Log correlation is good, but the solution is slow and there are many licensing complications
    Pros and Cons
    • "The log correlation is good."
    • "The deployment process is complex. I don't know why, but this solution will suddenly stop working. Logs stop coming. Often, one thing or another stops working. Most of the time, one of my team members is working with troubleshooting and working with technical support. Log passing is also one of the biggest challenge."

    What is our primary use case?

    The product is mainly used for security, log reviews, and monitoring.

    In India, mostly on the requirement segment, we don't deploy the solution on the cloud. We use the solution on-premises.

    What is most valuable?

    The log correlation is good. There may be some benefits to the solution, but most of my time has gone to configure it rather than to work with it. So maybe I'm not so aware of that.

    What needs improvement?

    The problem with this product is that it's a bit slow. I am not very happy with this product. In the past, I have worked with a different tool, which was only maintaining a log, but I found that solution much better than NetWitness. It is not properly configured yet.

    One part of this product that needs to be improved is the log passing. Often, it doesn't work or logs go missing. There are many licensing complications as well.

    For how long have I used the solution?

    I have been working with this product for almost one year. I'm not working directly with the product. I do the implementation for companies. We use the latest versions of the solution.

    I'm technically not hands-on with these tools because I manage the team, so I am not exposed to anything.

    What do I think about the stability of the solution?

    My own network is very complex. It might be stable, but many times, even our appliances are not. We have had improper shutdowns, so I will not blame RSA. If an improper shutdown happens, then it takes a lot of time to make it up. It doesn't work until you start the machine, and it will work. Finally, you have to get a ticket, then they will do lots of things on them. The services will start and then it will work. We've been having some power issues in my previous assignments, and a lot of trouble in that way.

    What do I think about the scalability of the solution?

    The solution is scalable. It creates 3,000 lab logs per second. I think the solution is suitable for large companies, or medium to large companies.

    How are customer service and support?

    I don't think RSA has good support.

    How was the initial setup?

    The deployment process is complex. I don't know why, but this solution will suddenly stop working. Logs stop coming. Often, one thing or another stops working. Most of the time, one of my team members is troubleshooting and working with technical support. Log passing is also one of the biggest challenges. Sometimes you don't get the logs, but even when we make the log passes, they don't work. They suddenly stop working. It might just be a problem from my side as well, but the end result is that it is not working as smoothly as it should.

    Deployment time just depends on different circumstances. Many times, our men were unable to get to the data center. There were some wiring problems and improper shutdowns. We did have trouble with connecting with other people in our department. It took an unusual amount of time. I think we should have been done in 45 to 60 days, but it took us more than eight or nine months to get it done. The deployment time just depends on the current scenario. Tech support would say, "We don't do this, we don't do that. You have to purchase that service and that service."

    What's my experience with pricing, setup cost, and licensing?

    The pricing is not very economical. It is a costly product for India. When you purchase it, you have to purchase a module separately.

    What other advice do I have?

    I would rate this solution 4 out of 10. I would not suggest that someone use this solution because support is a main issue. I would prefer to go with IBM QRadar or some other new AI-based tools.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: My company has a business relationship with this vendor other than being a customer: Partner
    Flag as inappropriate
    CEO & Founder at a tech services company with 1-10 employees
    Real User
    Top 20
    A stable solution that captures traffic with detailed communication logs
    Pros and Cons
    • "The most valuable feature is the way it captures the traffic, and it contains every detail of the communication."
    • "When analyzing something, you have to click several times. It requires a lot of effort to find something."

    What is our primary use case?

    We are using this solution as a network forensic tool with other security devices such as IPS and SIEM.

    What is most valuable?

    The most valuable feature is the way it captures the traffic, and it contains every detail of the communication.

    What needs improvement?

    When analyzing something, you have to click several times. It requires a lot of effort to find something. The sole purpose of NetWitness is to find text easily, so this is an area that needs to be improved.

    The scalability needs improvement, but I think that it is technically difficult.

    This is a complex tool to use.

    In the next release, if they could include a detection feature or improve the detection then I would like it better.

    For how long have I used the solution?

    I have been working with this solution for about one year.

    What do I think about the stability of the solution?

    This solution is very stable.

    What do I think about the scalability of the solution?

    It does not scale. It's one network segment that captures all of the traffic, so it's not scalable at all.

    We have six analysts who use this product, with maybe only three or four people in our company.

    How are customer service and technical support?

    For support, we contact our reseller.

    How was the initial setup?

    The initial setup is not complex, it was easy.

    We deployed everything on port mirroring.

    What about the implementation team?

    I set up this solution by myself.

    What other advice do I have?

    Architects love to use this tool, but the analysis is very complex, which is the point of NetWitness Network.

    It's not the best, but it's good. The analytics is probably a ten but because it is complex, but overall, I would rate this solution an eight out of ten.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: I am a real user, and this review is based on my own experience and opinions.
    Find out what your peers are saying about RSA, ExtraHop Networks, Darktrace and others in Network Traffic Analysis (NTA). Updated: January 2022.
    563,327 professionals have used our research since 2012.
    Maged Magdy
    Security Consultant at Global Solutions
    Real User
    Top 5Leaderboard
    Great visualizations, stable, and easy to use and deploy

    What is our primary use case?

    It is our all-in-one platform for logs and packets for our network and for EDR.

    What is most valuable?

    It is very easy to use, and its usability is great. The use cases are also very easy.  The visualizations of the use cases are magnificent. You cannot find this in any other solution. From my point of view, it is great.

    What needs improvement?

    Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training.

    For how long have I used the solution?

    I have been using this solution for about two or three years.

    What do I think about the stability of the solution?

    It is very stable.

    What do I think about the scalability of the solution?

    It…

    What is our primary use case?

    It is our all-in-one platform for logs and packets for our network and for EDR.

    What is most valuable?

    It is very easy to use, and its usability is great. The use cases are also very easy. 

    The visualizations of the use cases are magnificent. You cannot find this in any other solution. From my point of view, it is great.

    What needs improvement?

    Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training.

    For how long have I used the solution?

    I have been using this solution for about two or three years.

    What do I think about the stability of the solution?

    It is very stable.

    What do I think about the scalability of the solution?

    It is not meant for small businesses. It is for medium to very large enterprises.

    How are customer service and technical support?

    They have very good staff in tech support.

    How was the initial setup?

    Its installation is easy. 

    What about the implementation team?

    I did it myself.

    What's my experience with pricing, setup cost, and licensing?

    It is an expensive product.

    What other advice do I have?

    I would rate RSA NetWitness Network a ten out of ten.

    Which deployment model are you using for this solution?

    On-premises
    Disclosure: I am a real user, and this review is based on my own experience and opinions.