Try our new research platform with insights from 80,000+ expert users

Arbor DDoS vs NetWitness Platform comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Arbor DDoS
Average Rating
8.6
Number of Reviews
48
Ranking in other categories
Distributed Denial of Service (DDOS) Protection (2nd)
NetWitness Platform
Average Rating
7.4
Number of Reviews
36
Ranking in other categories
Log Management (25th), Security Information and Event Management (SIEM) (24th)
 

Mindshare comparison

Arbor DDoS and NetWitness Platform aren’t in the same category and serve different purposes. Arbor DDoS is designed for Distributed Denial of Service (DDOS) Protection and holds a mindshare of 15.8%, up 14.1% compared to last year.
NetWitness Platform, on the other hand, focuses on Log Management, holds 0.4% mindshare, down 0.5% since last year.
Distributed Denial of Service (DDOS) Protection
Log Management
 

Featured Reviews

Tushar Sail - PeerSpot reviewer
Mar 15, 2023
A critical solution for security, as it includes features that can automatically detect and prevent DDoS attacks
Arbor DDoS offers security features that automatically detect and prevent DDoS attacks. When a DDoS attack is detected targeting a specific IP, the Arbor device immediately becomes in line with the traffic and actively works to prevent the attack. This auto feature is one of the best aspects of…
MdZaman - PeerSpot reviewer
Oct 22, 2021
Really scalable for enterprise customers
The solution should have more integration capabilities with different platforms. The API is nearly open and scalable, so the solution can integrate with many platforms. The solution has more than 200 log sources in the scalability to support, but this is its limit. Installation is pretty easy. However, there are a couple of modules involved, so it is not as easy as it could be. We are talking about a distributed module, not a single-module type. This is what makes things a bit complex, instead of easier. I rate it as a seven out of ten on its installation and configuration capabilities.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is fully mitigating the attacks. We've dealt with other ones where we didn't necessarily see that. The detection is very good. It's also very simple to use. Arbor is a single pane of glass, whereas with other solutions you might have a detection pane of glass and then have to go to a separate interface to deal with the mitigation. That single pane of glass makes it much simpler."
"Analytics and its attack mitigation capabilities are valuable features of the solution."
"The auto-mitigation, that signaling feature, where it automatically raises an alarm that a line is under attack, is important. The upstream service provider will then do something to reduce the load on our internet lines. The fact that it's automated means I don't have to sit and always be looking at threats coming through. It does it almost automatically, without any intervention by me."
"It's very flexible and we can easily deploy it to our network. It's very user-friendly. We can do everything via the web interface and troubleshoot easily from the CLI. It's not complicated."
"We use it not only for DDoS detection and protection, but we also use it for traffic analysis and capacity planning as well. We've also been able to extend the use of it to other security measures within our company, the front-line defense, not only for DDoS, but for any kind of scanning malware that may be picked up. It's also used for outbound attacks, which has helped us mitigate those and lower our bandwidth costs..."
"With real-time packet capture features, you can easily and quickly response."
"We can reduce the bandwidth to minimize the attack level. If we see more than 2.5 GBs we drop it directly."
"Reporting is quite good. There are several pages of reporting on DDoS attacks, and you can find all the details that you need."
"The most valuable features are the threat prediction and network forensics."
"The product's initial setup phase was not at all difficult."
"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."
"The software is scalable to whatever is required, and you can also put a lot of resources in the cloud."
"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."
"The most valuable features are its ingestion of logs and raising of alerts based on those logs."
"It's quite economical compared to other solutions in the market."
"The development of use cases on the SSA console is quite user friendly. This means that the security analyst or the researcher does not have to learn another language."
 

Cons

"The following areas need improvement: opening and tracking support tickets, online support resources, software upgrades/updates and replacement media, and event management guidelines."
"We need a SaaS model for the solution."
"When it comes to some false positives, we need to tweak the system from time to time. There is room for improvement when it comes to the actual mitigation because of some false positives."
"An improvement would be to provide information on how pricing is done on different customer levels."
"The support got worse after NETSCOUT acquired Arbor."
"There should be an automatic way to configure it to monitor traffic and decide which is an attack and which is not. In Arbor, you need to tweak and set all parameters manually, whereas in Check Point DDoS Protector, you can select the lowest parameters, and over the weeks, Check Point DDoS Protector will learn the traffic and you can then tighten some of the parameters to decide which traffic is regular and which is malicious."
"Implementation could be better."
"With Arbor DDoS, its integration issues with other technologies or other vendors' technologies is an area of concern that could be improved."
"The initial setup is complex. There are other solutions that are easier to implement."
"Sometimes, it gives me static when integrating Windows-based systems. It should produce a precise log of sorts as to where the problem is. For example, a few days ago because of the McAfee application firewall, I couldn't get access to the particular Windows machine. So, my team and I had to figure out by ourselves that there was a virus responsible for the obstacle. This solution should trigger a meaningful log or message indicating the reason the user or implementer can't get into the machine."
"Its technical support could be better."
"Security needs improvement."
"Health monitoring of the event sources and devices."
"The tool's integration capability isn't so great."
"The log system is a bit complex and has room for improvement."
"We have encountered issues with unresolved crashes."
 

Pricing and Cost Advice

"The solution is a bit costly if you're a small organization, but I think it's worth the price that they are charging."
"You need to find a way to get a good offering from Arbor by negotiating a price. That is the challenge."
"Because the solutions from competitors are very different, it's not easy to compare. However, the licensing from Arbor is clear and understandable and the pricing is reasonable when looking at the market, in general."
"Regarding pricing, I would rate it as average. Arbor DDoS offers good value for money with our DDoS filter device. For higher protection needs, Arbor’s CloudMeter’s DDoS mitigation or hardware devices might be more expensive, but customers who need them are usually prepared for the cost and the additional resources required."
"As far as I know, they are the best in this sector, in DDoS protection. They know it, I know, because their service prices are too high. They provide cloud DDoS protection for ISPs, but that is also too expensive."
"Arbor is striking a good balance between pricing and what they deliver."
"The price of Arbor DDoS depends on many parameters. It depends on the physical capacity of the environment, and it is not a straight-line price. It's fairly competitive in the market on the price."
"Arbor DDoS is quite expensive, but all these solutions are expensive because they deal with confidential information."
"It is cheap."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"This is a pricey solution; it's not cheap."
"The product price was reasonable for my region and the market."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
"Compared to the competition, the is price is not that high."
"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"It’s cheaper to run virtual machines in a VMware environment."
report
Use our free recommendation engine to learn which Distributed Denial of Service (DDOS) Protection solutions are best for your needs.
814,649 professionals have used our research since 2012.
 

Comparison Review

VS
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Computer Software Company
15%
Comms Service Provider
9%
Government
6%
Financial Services Firm
17%
Computer Software Company
17%
Government
7%
Insurance Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
I would say if it’s an ISP that will build a scrubbing center, Netscout/Arbor is a good solution. In all other solutions, Imperva is a great choice.
Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Arbor would be the best bid, apart from Arbor, Palo Alto and Fortinet have good solutions. As this is an ISP, I would prefer Arbor.
What do you like most about Arbor DDoS?
The quality of the technical support provided by Arbor DDoS is premium.
What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The product price was reasonable for my region and the market.
What needs improvement with NetWitness Platform?
From an improvement perspective, the NetWitness Platform needs to release new features and improve in areas like log correlation. The tool needs to have easier integrations with the cloud. Building...
 

Also Known As

Arbor Networks SP, Arbor Networks TMS, Arbor Cloud for ENT
RSA Security Analytics
 

Learn More

Video not available
 

Overview

 

Sample Customers

Xtel Communications
Los Angeles World Airports, Reply
Find out what your peers are saying about Cloudflare, NETSCOUT, Radware and others in Distributed Denial of Service (DDOS) Protection. Updated: October 2024.
814,649 professionals have used our research since 2012.