NetWitness NDR vs Vectra AI comparison

Read 42 Vectra AI reviews

8,807 Views
4,241 Comparison Views

97% willing to recommend

NetWitness NDR

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between NetWitness NDR and Vectra AI based on real PeerSpot user reviews.

Find out in this report how the two Network Detection and Response (NDR) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed NetWitness NDR vs. Vectra AI Report (Updated: August 2024).

NetWitness NDR vs. Vectra AI

Download the complete report

Helped 801,394 peers since 2012

Categories and Ranking

NetWitness NDR

Ranking in Network Detection and Response (NDR)

15th

Ranking in Extended Detection and Response (XDR)

28th

Average Rating

8.0

Number of Reviews

Ranking in other categories

Endpoint Protection Platform (EPP) (53rd), Threat Intelligence Platforms (24th), Endpoint Detection and Response (EDR) (50th), Security Orchestration Automation and Response (SOAR) (22nd)

Vectra AI

Ranking in Network Detection and Response (NDR)

2nd

Ranking in Extended Detection and Response (XDR)

9th

Average Rating

8.6

Number of Reviews

Ranking in other categories

Intrusion Detection and Prevention Software (IDPS) (2nd), Identity Threat Detection and Response (ITDR) (6th), AI-Powered Cybersecurity Platforms (3rd)

Mindshare comparison

As of September 2024, in the Network Detection and Response (NDR) category, the mindshare of NetWitness NDR is 1.9%, down from 2.5% compared to the previous year. The mindshare of Vectra AI is 21.7%, up from 20.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Network Detection and Response (NDR)

Featured Reviews

SupravatMaji

Associate Vice President - IT Security at Inspira Enterprise

Jun 23, 2022

Beneficial single unified dashboard, good native application integration, and high availability

The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good RSA NetWitness Network could improve on integration with non-native application…

Read full review

reviewer2120730

CSirt Manager at a construction company with 10,001+ employees

Mar 7, 2023

Helps us to have more visibility in terms of what happens in our network and the network at large

In terms of valuable features, I like the ability to record the traffic and the metadata in the traffic. I also like the ability to rewind the past and be able to understand what happened. Some of my colleagues like the ability to investigate incidents. Vectra AI has had a positive effect on the productivity of our company's top teams. They use it a lot to understand what's going on. However, we still need to teach people how to use it to its full potential because it's quite a complicated product. The Sidekick MDR service is quite important to our organization’s security monitoring and management. The Sidekick team is able to give us the ins and outs of what's going on with some incidents. They are able to triage and help us to focus on a particular part of detection. They also gave us advice on how to configure some parts of the product. The two people I worked with from the MDR service are really good at what they do, and it's quite nice to work with them.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature is the way it captures the traffic, and it contains every detail of the communication."

"The stability of the RSA NetWitness Endpoint is very good."

"This solution allows us to locate the malware in real-time."

"It helps our security team respond more accurately when there are threats, then we get less false positives or negatives."

"RSA NetWitness does market analysis in a more granular form. It gives you full visibility."

"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."

"Technical support is knowledgeable."

"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."

More NetWitness NDR pros

"The solution provide visibility into behaviors across the full lifecycle of an attack in our network, beyond just the Internet gateway. It makes our security operations much more effective because we are now looking not just at traffic on the border, but we're looking at east-west internal traffic. Now, not only will we see if an exploit kit is being downloaded, but we would be able to see then if that exploit kit was then laterally distributed into our environment."

"It gives you access, with Recall, to instant visibility into your network through something like a SIEM solution. For us, being able to correlate all of this network data without having to manage it, has provided immediate value. It gives us the ability to really work on the stuff where I and my team have expertise, instead of having to manage a SIEM solution..."

"The packet-capturing feature is very useful."

"Scalability wise, we have many sensors, and Vectra AI seems to handle them all very well."

"It keeps up with the network traffic, which is a good thing. It provides more context to plain alerts compared to using an older system. So, it helps an analyst reduce the information overload."

"The UI is easy to use and when we send detection to everybody, they easily understand what we are asking at the time."

"Vectra is very compatible with various cloud providers, such as Amazon and Azure AD. This is helpful as customers often migrate their network infrastructure to the cloud."

"It's important for us that the user interface is easy to understand and that is the biggest benefit we see from Vectra AI."

More Vectra AI pros

Cons

"This solution needs an upgrade in reporting. I have heard from RSA that they are working on this, but as of yet it is not available."

"We would like to see the hunting and investigation features of this solution improved, in order to provide better visibility of issues."

"The solution is modular, for example you can buy the RSA ePack, which you buy as a module is not part of the conduit solution. They could include it and have it as an all-in-one solution."

"I would like to see Security Orchestration and Response Automation (SOAR) integration."

"NetWitness Endpoint's blocking feature does not work properly - if there's a malicious process, it's not possible to kill it via a custom rule unless and until it's flagged as malicious."

"The initial setup requires a high level of skill."

"The solution lacks a reporting engine."

"RSA NetWitness Network could improve on integration with non-native application integration."

More NetWitness NDR cons

"I would like to see a bit more strategic metrics instead of technical data. Information that I could show to my executive management team or board would be valuable."

"Some of the customization could be improved. Everything is provided for you as an easy solution to use, but working with it and doing specific development could be worked on a bit more in the scope of an incident response team."

"It would be commercially beneficial if Vectra AI had something like Darktrace's Antigena Email or something similar to email protection."

"If you hit a certain number of rules, triage filters, or groups, the UX responds more slowly. However, we have a complex network and a lot of rules. So, our setup might not be a typical implementation example. We even had UX engineers onsite, and they looked at issues, improvements, and user feedback. Since then, it has gotten a lot better, they even built in features that we specifically requested for our company."

"Some of their integrations with other sources of data, like external threat feeds, took a bit more work than I had hoped to get integrated."

"I would like more integrations with IOCs and threats currently on the Internet. I would also like to know which threats are based on zero-day attacks, current botnets, etc. Therefore, I would like more information on external threats."

"We are using SMB 3.0, which is an encrypted protocol. When we get some alerts or something, we cannot go deep into the protocol to see what's wrong because it's encrypted. We need to decrypt the protocol in another way, which is quite difficult. We might go back to SMB 2.0 just for this reason, but that's not a good solution."

"There is room for improvement in the documentation. We would like to have more details on how it detects what we see."

More Vectra AI cons

Pricing and Cost Advice

"The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."

"It is highly scalable. It can be bought based on your requirements."

"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."

"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."

"It is an expensive product."

"The cost depends on the number of endpoints that you want to monitor, but it is not expensive."

"With RSA, there is flexibility in choosing the service, products, and the range that meets your requirement, as well as they are flexible in terms of pricing."

"I do not have any opinion on the pricing or licensing of the product."

More NetWitness NDR pricing and cost advice

"The licensing is on an annual basis."

"The pricing is high."

"Cost is a big factor, as always. However, I think we have a very good price–performance ratio."

"We are running at about 90,000 pounds per year. The solution is a licensed cost. The hardware that they gave us was pretty much next to nothing. It is the license that we're paying for."

"Vectra AI is not a cheap solution."

"Vectra is a bit on the higher side in terms of price, but they have always been transparent. The reason that they are this good is that they invest, so they need to charge accordingly."

"The solution is low-cost and affordable."

"The pricing is very good. It's less expensive than many of the tools out there."

More Vectra AI pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Network Detection and Response (NDR) solutions are best for your needs.

See recommendations

801,394 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

15%

Government

Manufacturing Company

Computer Software Company

17%

Financial Services Firm

13%

Government

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about NetWitness XDR?

Technical support is knowledgeable.

What is your experience regarding pricing and costs for NetWitness XDR?

The solution is expensive. I'd rate it at a one or two out of five. They need to adjust it to keep up with the competition. I cannot speak to the exact pricing of the product.

What needs improvement with NetWitness XDR?

I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat intelligence feeds. We would like to have more IOCs or more trade intelligence to n...

What is the biggest difference between Corelight and Vectra AI?

The two platforms take a fundamentally different approach to NDR. Corelight is limited to use cases that require the eventual forwarding of events and parsed data logs to a security team’s SIEM or ...

What do you like most about Vectra AI?

The solution is currently used as a central threat detection and response system.

What is your experience regarding pricing and costs for Vectra AI?

The licensing is on annual basis.

Darktrace vs NetWitness NDR

Comparisons

Compared 14% of the time

CrowdStrike Falcon vs NetWitness NDR

Compared 10% of the time

ExtraHop Reveal(x) vs NetWitness NDR

Compared 9% of the time

Cortex XDR by Palo Alto Networks vs NetWitness NDR

Compared 8% of the time

SentinelOne Singularity Complete vs NetWitness NDR

Compared 8% of the time

More NetWitness NDR Competitors

Darktrace vs Vectra AI

Compared 36% of the time

ExtraHop Reveal(x) vs Vectra AI

Compared 12% of the time

Cisco Secure Network Analytics vs Vectra AI

Compared 6% of the time

Arista NDR vs Vectra AI

Compared 6% of the time

Corelight vs Vectra AI

Compared 5% of the time

More Vectra AI Competitors

Product Reports

NetWitness NDR

Download NetWitness NDR product report

Download Vectra AI product report

Also Known As

RSA ECAT, NetWitness Network

Vectra Networks, Vectra AI NDR

Learn More

Video not available

NetWitness

Overview

Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.

Vectra AI is used for detecting network anomalies and potential malicious activities, providing visibility into network traffic and enhancing threat detection across environments.

Organizations deploy Vectra AI mainly on-premises with additional cloud components. It helps with compliance, incident response, security monitoring, detecting insider threats, and correlating network events. Vectra AI captures and enriches network metadata, provides detailed dashboards, reduces false positives, and supports cross-environment behavioral analysis to enhance threat detection and prioritization. While valued for its high accuracy and alert aggregation, it has room for improvement in UI/UX, packet management, and integration with SIEMs and other tools. It is noted for expensive pricing and limited proactive threat response features.

What are Vectra AI's most valuable features?

High accuracy in identifying threat locations
Aggregation of alerts into single incidents
24/7 threat detection
Visibility into the entire attack lifecycle
Risk score aggregation
Effective triaging of alerts
Integration with other tools

What benefits or ROI should users look for?

Enhanced threat detection and prioritization
Comprehensive network visibility
Reduction in false positives
Better incident response capabilities
Improved compliance monitoring

In specific industries, Vectra AI is deployed to monitor complex networks and alleviate challenges in threat detection. It is particularly effective in sectors requiring stringent compliance and security measures, offering insights and capabilities crucial for protecting sensitive data and maintaining operational integrity.

Sample Customers

ADP, Ameritas, Partners Healthcare

Tribune Media Group, Barry University, Aruba Networks, Good Technology, Riverbed, Santa Clara University, Securities Exchange, Tri-State Generation and Transmission Association

NetWitness NDR vs. Vectra AI