Microsoft Sentinel vs NetWitness Platform comparison

Microsoft and NetWitness are both solutions in the Security Information and Event Management (SIEM) category. Microsoft is ranked #3 with an average rating of 8.4, while NetWitness is ranked #24 with an average rating of 7.8. Microsoft holds a 8.7% mindshare in SIEM, compared to NetWitness’s 0.7% mindshare. Additionally, 93% of Microsoft users are willing to recommend the solution, compared to 74% of NetWitness users who would recommend it.

Microsoft Sentinel

Read 89 Microsoft Sentinel reviews

16,740 Views
9,816 Comparison Views

93% willing to recommend

NetWitness Platform

Read 36 NetWitness Platform reviews

1,290 Views
831 Comparison Views

74% willing to recommend

Microsoft Sentinel

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 18, 2024

NetWitness Platform and Microsoft Sentinel are leading solutions in cybersecurity. Based on user reviews, Microsoft Sentinel often stands out due to its comprehensive features and integration capabilities, making it a preferred choice despite potentially higher costs.

Features: NetWitness Platform is praised for its robust threat detection and response capabilities. It offers in-depth packet capture and session analysis, providing granular visibility into network activity. The platform also includes behavior analytics to detect threats based on deviations from normal patterns. Microsoft Sentinel features advanced AI-driven analytics, automating threat detection and response processes. It includes seamless integration with other Microsoft products, enhancing its utility in Microsoft-centric environments. Additionally, Sentinel offers built-in orchestration and automation for streamlined security operations.

Room for Improvement: Users suggest that NetWitness Platform could benefit from enhanced scalability, more intuitive navigation, and better integration with third-party tools. Microsoft Sentinel users request improved alerting mechanisms, more customizable reporting options, and a more user-friendly interface. While suggestions for NetWitness are aimed at usability enhancements, Sentinel users focus on functional refinements.

Ease of Deployment and Customer Service: NetWitness Platform is noted for its straightforward deployment process and reliable customer support. Microsoft Sentinel receives positive feedback for deployment, especially in cloud environments, but some users find its initial setup complex. Customer service for Sentinel garners mixed reviews, with some users experiencing delays in support.

Pricing and ROI: NetWitness Platform is generally seen as requiring a significant initial investment, but users report good ROI over time. Microsoft Sentinel is perceived as more expensive, yet users feel the comprehensive feature set and integration justify the cost, leading to a strong ROI. Pricing strategies differ, with Sentinel's flexible cloud-based pricing appealing to many users. Differences in perceived value highlight each product's pricing strategy and return on investment dynamics.

To learn more, read our detailed Microsoft Sentinel vs. NetWitness Platform Report (Updated: December 2024).

Buyer's Guide

Microsoft Sentinel vs. NetWitness Platform

December 2024

Download the complete report

Helped 824,053 peers since 2012

Categories and Ranking

Microsoft Sentinel

Ranking in Security Information and Event Management (SIEM)

3rd

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Security Orchestration Automation and Response (SOAR) (1st), Microsoft Security Suite (5th), AI-Powered Cybersecurity Platforms (5th)

NetWitness Platform

Ranking in Security Information and Event Management (SIEM)

24th

Average Rating

7.4

Reviews Sentiment

7.5

Number of Reviews

Ranking in other categories

Log Management (23rd)

Mindshare comparison

As of December 2024, in the Security Information and Event Management (SIEM) category, the mindshare of Microsoft Sentinel is 8.7%, down from 10.4% compared to the previous year. The mindshare of NetWitness Platform is 0.7%, down from 0.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

Nitin Arora

Security Delivery Senior Analyst at Accenture

Gives us one place to investigate and respond to threats, and automation eliminates manual work

They can work on the EDR side of things. It is already really superb, because of the kinds of features we get with the EDR solution. It's not a standard EDR and they have recently enhanced things. But the problem is with onboarding devices. I have different OS flavors, including a large number of Linux, Windows, macOS, and some on-prem machines as well. Every time we need to onboard these kinds of machines into the EDR, we need to do it with the help of Intune, to sync up the devices, and do the configuration. I'm looking for something on the EDR side that will reduce this kind of work. They can eliminate having to do manual configuration for the machines, and check the different types of configurations for each OS. In some cases, it does not support some OSs. If they could reduce this type of work, that would be really amazing.

Read full review

MdZaman

IT manager at a agriculture with 10,001+ employees

Really scalable for enterprise customers

The solution should have more integration capabilities with different platforms. The API is nearly open and scalable, so the solution can integrate with many platforms. The solution has more than 200 log sources in the scalability to support, but this is its limit. Installation is pretty easy. However, there are a couple of modules involved, so it is not as easy as it could be. We are talking about a distributed module, not a single-module type. This is what makes things a bit complex, instead of easier. I rate it as a seven out of ten on its installation and configuration capabilities.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Free ingestion for Azure logs (with E5 licence)"

"Sentinel has features that have helped improve our security poster. It helped us in going ahead and identifying the gaps via analysis and focusing on the key elements."

"The ability of all these solutions to work together natively is essential. We have an Azure subscription, including Log Analytics. This feature automatically acts as one of the security baselines and detects recommendations because it also integrates with Defender. We can pull the sysadmin logs from Azure. It's all seamless and native."

"The part that was very unexpected was Sentinel's ability to integrate with Azure Lighthouse, which, as a managed services solution provider, gives us the ability to also manage our customers' Sentinel environments or Sentinel workspaces. It is a big plus for us. With its integration with Lighthouse, we get the ability to monitor multiple workspaces from one portal. A lot of the Microsoft Sentinel workbooks already integrate with that capability, and we save countless amounts of money by simply being able to almost immediately realize multitenant capabilities. That alone is a big plus for us."

"Mainly, this is a cloud-native product. So, there are zero concerns about managing the whole infrastructure on-premises."

"It has a lot of great features."

"The product can integrate with any device."

"We’ve got process improvement that's happened across multiple different fronts within the organization, within our IT organization based on this tool being in place."

More Microsoft Sentinel pros

"It gives the ability to investigate into network traffic in the Net and the organization what we couldn't do before."

"Performance and reporting are very good."

"The product's initial setup phase was not at all difficult."

"Offers a good wireless feature."

"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."

"What we are mainly using are the RSA concentrator, RSA Decoder, Archiver, Broker, and Log Decoder."

"The most valuable features are the packet decoder, log decoder, and concentrator."

"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."

More NetWitness Platform pros

Cons

"We'd like to see more connectors."

"They're giving us the queries so we can plug them right into Sentinel. They need to have a streamlined process for updating them in the tool and knowing when things are updated and knowing when there are new detections available from Microsoft."

"The solution could be more user-friendly; some query languages are required to operate it."

"We do see continuous improvement all the time, however, I haven't got a specific feature that is lacking or not well designed."

"It has been a challenge with Azure Sentinel to onboard the Syslog server from FortiGate. Azure Sentinel can work better on that shift between the Syslog server and a firewall."

"The performance could be improved. If I create 15 to 20 lines for a single-use case in KQL, sometimes it takes more time to execute. If I create use cases within a certain timeline, the result will show in .01 seconds. A complex query takes more time to get results."

"The solution could improve the playbooks."

"Sentinel should be improved with more connectors. At the moment, it only covers a few vendors. If I remember correctly, only 100 products are supported natively in Sentinel, although you can connect them with syslog. But Microsoft should increase the number of native connectors to get logs into Sentinel."

More Microsoft Sentinel cons

"The initial setup is complex. There are other solutions that are easier to implement."

"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."

"The system looks like it is a mix of a bunch of different systems, and nothing looked like it was quite together."

"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."

"RSA NetWitness Logs and Packets can improve the threat level aspect, it is lacking compared to other solutions. Whenever any hacking activity or any other threat factor occurred they used to provide the coverages very fast when comparing RSA NetWitness Logs and Packets. I heard the other three solutions, from a discussion with my team members who had experience in other solutions, they used to say that. Whenever any issues happened across the globe RSA NetWitness Logs and Packets are a little bit slow improving those detection mechanisms."

"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."

"The initial setup was complex because it takes a lot of time to complete the implementation."

"There is no support for this product in this country, so problems have to be resolved through global technical teams."

More NetWitness Platform cons

Pricing and Cost Advice

"Currently, given our use case, the cost of Sentinel is justified, but it is expensive."

"Microsoft Sentinel is expensive."

"We only pay for the amount of data we bring in, which is fair."

"It varies on a case-by-case basis. It is about $2,000 per month. The cost is very low in comparison to other SIEMs if you are already a Microsoft customer. If you are using the complete Microsoft stack, the cost reduces by almost 42% to 50%. Its cost depends on the number of logs and the type of subscription you have. You need to have an Azure subscription, and there are charges for log ingestion, and there are charges for the connectors."

"The pricing is based on how much you ingest, so it's pretty straightforward. There are no tiers, and you pay for what you use unlike with other types of SIEM solutions that are usually based on tiers."

"For us, it is not expensive at this time, but if we start to collect all logs from our on-premise SIEM solutions, it will cost more than QRadar. If we calculate its cost over the next five or ten years, it will cost more than what we paid for QRadar."

"It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."

"Microsoft Sentinel's pricing is relatively expensive and extremely confusing."

More Microsoft Sentinel pricing and cost advice

"This is a pricey solution; it's not cheap."

"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."

"The licenses are good but the cost is very expensive."

"We are on an annual license for the use of the solution."

"Compared to the competition, the is price is not that high."

"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."

"The product price was reasonable for my region and the market."

"It’s cheaper to run virtual machines in a VMware environment."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

824,053 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Computer Software Company

16%

Financial Services Firm

10%

Government

Manufacturing Company

Financial Services Firm

18%

Computer Software Company

17%

Insurance Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?

Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and its Threat Hunting functionality with AI available as templates or customized ...

See all answers

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

See all answers

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will...

See all answers

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The product price was reasonable for my region and the market.

See all answers

What needs improvement with NetWitness Platform?

From an improvement perspective, the NetWitness Platform needs to release new features and improve in areas like log correlation. The tool needs to have easier integrations with the cloud. Building...

See all answers

Comparisons

AWS Security Hub vs Microsoft Sentinel

Compared 21% of the time

IBM Security QRadar vs Microsoft Sentinel

Compared 10% of the time

Cortex XSIAM vs Microsoft Sentinel

Compared 7% of the time

Wazuh vs Microsoft Sentinel

Compared 6% of the time

Google Chronicle Suite vs Microsoft Sentinel

Compared 5% of the time

More Microsoft Sentinel Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 37% of the time

IBM Security QRadar vs NetWitness Platform

Compared 15% of the time

RSA enVision vs NetWitness Platform

Compared 12% of the time

Cisco Secure Network Analytics vs NetWitness Platform

Compared 11% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 7% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

Microsoft Sentinel

November 2024

Download Microsoft Sentinel product report

Buyer's Guide

NetWitness Platform

December 2024

Download NetWitness Platform product report

Also Known As

Azure Sentinel

RSA Security Analytics

Learn More

Microsoft

Video not available

NetWitness

Overview

Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

- Respond to incidents rapidly with built-in orchestration and automation of common tasks

To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.

Los Angeles World Airports, Reply

Buyer's Guide

Microsoft Sentinel vs. NetWitness Platform

December 2024

Free Report: Microsoft Sentinel vs. NetWitness Platform

Find out what your peers are saying about Microsoft Sentinel vs. NetWitness Platform and other solutions. Updated: December 2024.

DOWNLOAD NOW

824,053 professionals have used our research since 2012.

See our Microsoft Sentinel vs. NetWitness Platform report.

See our list of best Security Information and Event Management (SIEM) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.