Try our new research platform with insights from 80,000+ expert users

Cisco Secure Network Analytics vs ExtraHop Reveal(x) comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024
 

Categories and Ranking

Cisco Secure Network Analytics
Ranking in Network Traffic Analysis (NTA)
3rd
Ranking in Network Detection and Response (NDR)
5th
Average Rating
8.2
Number of Reviews
59
Ranking in other categories
Network Monitoring Software (24th), Cisco Security Portfolio (4th)
ExtraHop Reveal(x)
Ranking in Network Traffic Analysis (NTA)
4th
Ranking in Network Detection and Response (NDR)
8th
Average Rating
8.6
Number of Reviews
12
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2024, in the Network Traffic Analysis (NTA) category, the mindshare of Cisco Secure Network Analytics is 19.2%, down from 23.0% compared to the previous year. The mindshare of ExtraHop Reveal(x) is 21.0%, up from 14.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Network Traffic Analysis (NTA)
 

Featured Reviews

Rainier S. - PeerSpot reviewer
Mar 22, 2018
You are able to drill down into a center's utilization, then create reports based on it
In the last year or two, we have been working with our Cisco NAS engineers to improve our security posturing. It is more our being proactive rather than reactive. While Stealthwatch and Lancope have this ability to look inside and give you visibility (a great feature), follow-up is the rule. We would like filters that you can put into place to tap onto certain types of behaviors, alerts out, and/or hopefully a block. This is sort of what we are looking for. I might be speaking too early, because we are not down this path yet. We know the feature set is there, we just do not know yet how to achieve it. That is proactive rather than more reactive. For Lancope Stealthwatch, we would like to see it more on the ASA Firewall platform. While this might already be available, this is more a failing of Cisco to inform us if it is there. For example: * Are we on the right or wrong version of the code? * What does the code look like? * Are we are really looking at firewalls? Or is it more about the foundation and route switches that we are seeing? It is about visibility.
Jordan Swanson - PeerSpot reviewer
Sep 7, 2022
It helps you visualize how data moves across your network
I rate ExtraHop Reveal(x) 10 out of 10. This is more of a nice-to-have rather than a must-have solution. Something like a CrowdStrike or a next-gen AV is an essential product, whereas NDR is more of a nice-to-have thing. If you only have a little bit of traffic, you're probably not going to get anything out of it. It's better for a medium-to-large enterprise. It's more appropriate for companies wh a massfootprints or industrial applications using use nonstandard devices. It's helpful for things that use SCADA, the Internet of Things, somethingings that don't fit neatly into other management categories. Itty common for industrial, construction, or maintenance devices to be a little lackluster in their security. Major breaches like the Colonial Pipeline hack and attempted hacks on nuclear power plants all went through Internet of Things vulnerabilities and other devices where security wasn't part of their plan. This helps you cover yourself by monitoring the traffic. With something like CrowdStrike, you need to put the CrowdStrike sensor on it, but Reveal(x) looks at everything on the network.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable features of this solution are the logging, keeping threats under control, and keeping our data and environment secure."
"The search options on Cisco Stealthwatch are the most valuable. You can get very granular with it, down to the kilobits or the seconds if you want. The product supports any time frame that you need, so that is nice."
"The most valuable feature is NetFlow. The beginning of any security investigation starts with NetFlow data."
"The solution reduces the amount of time it takes to detect and remediate threats."
"Being able to graph and show data to management has improved our organization. We can show the data to the higher-ups. It shows them that it's picking up on these anomalies and doing its job."
"Able to drill down into a center's utilization, then create reports based on it."
"It is a good application, providing for real-time monitoring of the organization of data. It can basically identify points of peak traffic where possible issues are being caused."
"We find that Stealthwatch can detect the unseen."
"The most valuable features of ExtraHop Reveal(x) are the detection and alerting of network behavior and anomalies."
"With ExtraHop Reveal(x), it gives me more visibility into the packets. It doesn't provide the entire packet capture, but it offers more information on how connections are made at the network layer. This can be helpful for detecting network attacks. Additionally, I really like the customizable dashboards and reports. The incident dashboard and alerts provide a good summary initially, and diving deeper into them gives more detailed information. It's also great for analyzing specific attacks and victim logs. The feature that tracks the full attack chain makes it easier to monitor the progress of attacks. Plus, it's connected to the Netria.com app, which I find useful for certain tasks."
"The solution works well for sending sensors."
"Setting up the solution is relatively easy."
"Reveal X integrates seamlessly with CrowdStrike. If you see something sketchy on the network, you can quarantine devices through ExtraHop and it'll push to the CrowdStrike server."
"It's a wire analytics tool. We use it for isolating and determining issues on our network or applications. It does a lot for crediting the network as opposed to discrediting the network. A lot of people come along and say that it's a network issue. It's always considered to be a network issue, but by using ExtraHop, we can quickly tell them that it's not a networking issue. It's something to do with your application or something at the other end. It could be a database issue. This tool gives us the ability to pinpoint with great accuracy the comings and goings on our network."
"ExtraHop Reveal(x) is one of the tools that works out of the box when it comes to threat hunting."
"The security features of this solution are the most valuable."
 

Cons

"It's too complicated to install, when starting out."
"Its granularity for RBAC roles-based access control needs improvement."
"There's a lot of traffic on our network that we don't see sometimes."
"There could be better integration on the programming side, which uses Python. StealthWatch could provide a template for Python to manage the switches. For example, it would be nice if StealthWatch bounced a port automatically it detected something anomalous."
"Complexity on integration is not so straightforward and you really need an expert to help build it out."
"At my company, we might not be using it enough with other applications that we have that can integrate with it."
"The version with the Dell server had iDRAC problems. Often, it reported iDRAC failure."
"We had some trouble with the installation as we migrated from our previous solution."
"There is a little training online, but it'd be cool if ExtraHop provided certifications. CrowdStrike does elective training that gives you a certification as a Falcon administrator. It'd be nice to see ExtraHop have something like that"
"ExtraHop Reveal(x) could improve by allowing a longer look back in the feature. Right now you have a limit of 30 days to look back on your activity. I've used Darktrace before, and they allow you the ability to play back events. This would be a good feature to have in ExtraHop Reveal(x)."
"I think the tuning capabilities could be improved. We're working on minimizing false positives. Apart from that, everything seems fine to me."
"Netflow - Processing Netflow can be cumbersome as it requires triggers to truly gain value and insight. This in turn can add a bit of load to the hardware. The focus of ExtraHop Reveal (x) is live packet data."
"The solution’s pricing could be improved."
"The solution's reporting part and GUI are areas with certain shortcomings where improvements are required."
"They used to have the ability to decode Citrix sign-on, setup, and tear down. Unfortunately, Citrix has stopped sharing that knowledge. Citrix has continued to change its model of processing, making it harder and harder to troubleshoot."
"It needs integration with more security vendors."
 

Pricing and Cost Advice

"The solution is expensive. It costs several hundred thousand dollars per year (depending on how many flows you are collecting)."
"Today, we are part of the big Cisco ELA, and it is a la carte. We can get orders for whatever we want. At the end of the day, we have to pay for it in one big expense, but that is fine. We are okay with that."
"​Licensing is done by flows per second, not including outside (in traffic)."
"Pricing is much higher compared to other solutions."
"The yearly licensing cost is about $50,000."
"Licensing is on a yearly basis."
"It has a subscription model. There is yearly support, and there is also three-year support. It depends on what the customers want."
"On a yearly basis, licensing is somewhere around $30,000."
"I rate ExtraHop Reveal(x) six out of 10 for affordability. We pay for an annual license. It's always one of those trade-offs. You get a lot of value, but ExtraHop isn't exorbitantly priced. You can pay extra for additional features like the ability to decode HL7 traffic, which is crucial for EMR environments."
"The solution is based on an annual subscription model and is expensive."
"I rate the price of ExtraHop Reveal(x) a seven on a scale of one to ten, where one is a high price, and ten is a low price."
"I would rate the price a three out of five. It could be less expensive."
report
Use our free recommendation engine to learn which Network Traffic Analysis (NTA) solutions are best for your needs.
814,649 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
31%
Financial Services Firm
11%
Government
8%
Manufacturing Company
6%
Financial Services Firm
16%
Computer Software Company
15%
Healthcare Company
6%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Cisco Stealthwatch?
The most valuable feature of Cisco Secure Network Analytics is the Threat Intelligence integration.
What is your experience regarding pricing and costs for Cisco Stealthwatch?
The tool is not cheaply priced. In cybersecurity, you want an extra layer of security in your organization. Some sectors want NDR solutions, so you cannot deploy such tools everywhere, as they are ...
What needs improvement with Cisco Stealthwatch?
The expensive nature of the tool is an area of concern where improvements are required.
What is the best network monitoring software for large enterprises?
We just did an assessment for our 47 datacenters around North America. The top two enterprise-level network monitoring solutions were ExtraHop first, Riverbed SteelCenter second. Their negotiated c...
What open source tool can one use to measure bandwidth from one's upstream service provider?
One I am looking closely at is AppNeta. They have an appliance that can digest the flow and do a better job than Netflow. The other one we are using is ExtraHop. This has both a Datacenter Hig...
What do you like most about ExtraHop Reveal(x)?
With ExtraHop Reveal(x), it gives me more visibility into the packets. It doesn't provide the entire packet capture, but it offers more information on how connections are made at the network layer....
 

Also Known As

Cisco Stealthwatch, Cisco Stealthwatch Enterprise, Lancope StealthWatch
Reveal(x), Revealx
 

Learn More

Video not available
 

Overview

 

Sample Customers

Edge Web Hosting, Telenor Norway, Ivy Tech Community College of Indiana, Webster Financial Corporation, Westinghouse Electric, VMware, TIAA-CREF
Wood County Hospital
Find out what your peers are saying about Cisco Secure Network Analytics vs. ExtraHop Reveal(x) and other solutions. Updated: October 2024.
814,649 professionals have used our research since 2012.