NetWitness NDR vs Tines comparison

NetWitness and Tines are both solutions in the Security Orchestration Automation and Response (SOAR) category. NetWitness is ranked #25, while Tines is ranked #10 with an average rating of 9.0. NetWitness holds a 0.8% mindshare in SOAR, compared to Tines’s 7.3% mindshare. Additionally, 87% of NetWitness users are willing to recommend the solution, compared to 100% of Tines users who would recommend it.

NetWitness NDR

Read 15 NetWitness NDR reviews

1,829 Views
201 Comparison Views

87% willing to recommend

Tines

Read 4 Tines reviews

2,306 Views
2,006 Comparison Views

100% willing to recommend

NetWitness NDR

Tines

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 9, 2024

NetWitness NDR and Tines are leading products in network detection and response and automation respectively. Tines is preferred due to higher user satisfaction with its feature adaptability and user-friendly deployment, despite NetWitness NDR's strong threat detection.

Features: NetWitness NDR offers advanced threat detection, detailed analytics, and seamless integration with existing security setups. Tines provides customizable workflows, efficient automation capabilities, and streamlined incident management.

Room for Improvement: NetWitness NDR has a steep learning curve, needs better documentation, and enhanced user support. Tines can improve its integration with certain third-party tools, refine its user interface, and expand its automation templates.

Ease of Deployment and Customer Service: NetWitness NDR's deployment process is complex and often requires extensive support. Tines has an intuitive deployment process with quick setup and responsive customer support.

Pricing and ROI: NetWitness NDR has higher initial setup costs but offers strong ROI through robust security features. Tines has a flexible pricing model, providing value through automation efficiencies and reduced manual effort.

To learn more, read our detailed NetWitness NDR vs. Tines Report (Updated: September 2025).

Buyer's Guide

NetWitness NDR vs. Tines

September 2025

Download the complete report

Helped 869,785 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

NetWitness NDR

Ranking in Threat Intelligence Platforms (TIP)

40th

Ranking in Security Orchestration Automation and Response (SOAR)

25th

Average Rating

8.0

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Endpoint Protection Platform (EPP) (59th), Endpoint Detection and Response (EDR) (63rd), Network Detection and Response (NDR) (19th), Extended Detection and Response (XDR) (37th)

Tines

Ranking in Threat Intelligence Platforms (TIP)

17th

Ranking in Security Orchestration Automation and Response (SOAR)

10th

Average Rating

9.0

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

AI-Powered Security Automation (1st)

Mindshare comparison

As of October 2025, in the Security Orchestration Automation and Response (SOAR) category, the mindshare of NetWitness NDR is 0.8%, up from 0.5% compared to the previous year. The mindshare of Tines is 7.3%, up from 4.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Orchestration Automation and Response (SOAR) Market Share Distribution
Product	Market Share (%)
Tines	7.3%
NetWitness NDR	0.8%
Other	91.9%

Security Orchestration Automation and Response (SOAR)

Featured Reviews

SupravatMaji

Associate Vice President - IT Security at Inspira Enterprise

Beneficial single unified dashboard, good native application integration, and high availability

My advice to those wanting to implement RSA NetWitness Network is they have to first do a little due diligence, such as the exact requirement based on their needs. That will give them a direction for their investment because otherwise, the bill of material or bill of quantity (BOQ) may be higher side. It is important to do good due intelligence on the environment, see the exact requirement, and then go ahead with the solution. The solution is perfectly stable. I rate RSA NetWitness Network a nine out of ten.

Read full review

VikramSingh8

Security Delivery Manager at Accenture

Automation simplifies workflows with no code and excellent support

Reporting and dashboards could be more advanced for deeper analysis. Tines has its own dashboard, which displays information like how many stories have been created and how many automations have taken place. However, the reporting and dashboard are not advanced; they are quite basic, with fewer customizable options. The look and feel of the dashboard could be enhanced. Another area for improvement is in terms of documentation, as every tool and company has its own knowledge base.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It is stable. We have been using it for some time, without any issues."

"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."

"Ability to isolate the machine when there are malicious files."

"The interface of this solution is very flexible and easy to use."

"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."

"The most valuable feature is the way it captures the traffic, and it contains every detail of the communication."

"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."

"We've contacted technical support several times. They've been very good. They have been able to help us resolve our issues."

More NetWitness NDR pros

"The tool was vendor-neutral."

"One of the most valuable features is that it’s a low-code solution."

"The best advantage is the no-code automation, excellent customer support services, and ease of integration with other tools."

"The best thing is that it's no code, so it doesn't require coding knowledge."

Cons

"The initial setup requires a high level of skill."

"Its price could be improved. It is an expensive product. Its training is also too expensive. It would be great if they can have a better pricing scheme for the training."

"Threat detection could be better."

"The solution is modular, for example you can buy the RSA ePack, which you buy as a module is not part of the conduit solution. They could include it and have it as an all-in-one solution."

"I would like to see Security Orchestration and Response Automation (SOAR) integration."

"The threat intelligence could improve in RSA NetWitness Endpoint."

"The integration of the solution needs to be improved. The dashboard needs lots of updates as well. In the next release, we would like to see advanced fraud detection features."

"The solution lacks a reporting engine."

More NetWitness NDR cons

"They started implementing some AI, and their AI is isolated."

"Tines was a little bit more expensive than Torq."

"Reporting and dashboards could be more advanced for deeper analysis."

"Maybe Tines can add more features and demonstrations, like videos on how to use the features within the tool."

Pricing and Cost Advice

"I do not have any opinion on the pricing or licensing of the product."

"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."

"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."

"It is an expensive product."

"The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."

"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."

"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."

"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."

More NetWitness NDR pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.

See recommendations

869,785 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

13%

Computer Software Company

12%

Manufacturing Company

Government

Financial Services Firm

13%

Computer Software Company

10%

Manufacturing Company

Healthcare Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	2
Large Enterprise	5

No data available

Questions from the Community

Ask a question

Earn 20 points

What needs improvement with Tines?

See all answers

What is your primary use case for Tines?

I am Vikram Singh, I work for top service based multinational brand and I am responsible for delivering Tines services. Essentially, I am working on it, and I am leading one of the source services ...

See all answers

What advice do you have for others considering Tines?

When you start working with Tines, ensure you pursue the Tines certifications. They offer these free certifications when they become your partner. Overall, I would rate Tines a nine out of ten.

See all answers

Comparisons

Darktrace vs NetWitness NDR

Compared 16% of the time

Cortex XDR by Palo Alto Networks vs NetWitness NDR

Compared 8% of the time

Fidelis Elevate vs NetWitness NDR

Compared 8% of the time

Vectra AI vs NetWitness NDR

Compared 6% of the time

Corelight vs NetWitness NDR

Compared 6% of the time

More NetWitness NDR Competitors

Torq vs Tines

Compared 46% of the time

Splunk SOAR vs Tines

Compared 11% of the time

Blink Ops vs Tines

Compared 10% of the time

Swimlane vs Tines

Compared 10% of the time

Cortex XSIAM vs Tines

Compared 1% of the time

More Tines Competitors

Product Reports

Buyer's Guide

NetWitness NDR

September 2025

Download NetWitness NDR product report

Buyer's Guide

Security Orchestration Automation and Response (SOAR)

October 2025

Download Tines product report

Also Known As

RSA ECAT, NetWitness Network

No data available

Overview

Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.

NetWitness

Tines offers no-code and low-code automation for users to automate tasks without coding expertise, integrating seamlessly with APIs to enhance incident management and security operations.

Known for a vendor-neutral approach, Tines provides detailed documentation and live chat support, allowing for effective integration with other tools, scheduling capabilities, and streamlined processes that save time and effort. Users find it intuitive for efficient task handling, making manual intervention unnecessary. Challenges include the need for more comprehensive documentation and instructional videos, as well as improvements in AI integration and reporting aesthetics. Pricing is also noted as higher compared to alternatives.

What are the most important features of Tines?

No-code and low-code automation: Enables task automation without coding knowledge.
API integration: Facilitates enhanced automation for security operations.
Vendor-neutral approach: Promotes unbiased integration across various tools.
Detailed documentation: Provides users with comprehensive guides and support.
Scheduling capabilities: Allows users to automate workflows efficiently.

What benefits and ROI can users expect from Tines?

Time savings: Automates tasks to reduce manual processes.
Improved efficiency: Streamlines security operations, enhancing productivity.
Comprehensive task handling: Offers intuitive tools for managing complex tasks easily.

Tines primarily serves organizations in the security sector, automating security operations such as alert detection and managed detection and response. It's utilized extensively in security operation centers for tasks like phishing email processing, ticket creation, IOC investigations, and ticket assignments within enterprise security frameworks, with multiple teams delivering Tines services to enhance task handling efficiency.

Tines

Sample Customers

ADP, Ameritas, Partners Healthcare

Information Not Available

Buyer's Guide

NetWitness NDR vs. Tines

September 2025

Free Report: NetWitness NDR vs. Tines

Find out what your peers are saying about NetWitness NDR vs. Tines and other solutions. Updated: September 2025.

DOWNLOAD NOW

869,785 professionals have used our research since 2012.

See our NetWitness NDR vs. Tines report.

See our list of best Security Orchestration Automation and Response (SOAR) vendors and best Threat Intelligence Platforms (TIP) vendors.

We monitor all Security Orchestration Automation and Response (SOAR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.