NetWitness Platform vs Splunk Enterprise Security comparison

NetWitness Platform vs. Splunk Enterprise Security

Download the complete report

Helped 845,040 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

NetWitness Platform

Ranking in Log Management

22nd

Ranking in Security Information and Event Management (SIEM)

22nd

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

No ranking in other categories

Splunk Enterprise Security

Ranking in Log Management

2nd

Ranking in Security Information and Event Management (SIEM)

1st

Average Rating

8.4

Reviews Sentiment

7.6

Number of Reviews

305

Ranking in other categories

IT Operations Analytics (1st)

Mindshare comparison

As of April 2025, in the Security Information and Event Management (SIEM) category, the mindshare of NetWitness Platform is 0.6%, down from 0.8% compared to the previous year. The mindshare of Splunk Enterprise Security is 9.5%, down from 12.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Featured Reviews

MdZaman

IT manager at a agriculture with 10,001+ employees

Really scalable for enterprise customers

The solution should have more integration capabilities with different platforms. The API is nearly open and scalable, so the solution can integrate with many platforms. The solution has more than 200 log sources in the scalability to support, but this is its limit. Installation is pretty easy. However, there are a couple of modules involved, so it is not as easy as it could be. We are talking about a distributed module, not a single-module type. This is what makes things a bit complex, instead of easier. I rate it as a seven out of ten on its installation and configuration capabilities.

Read full review

ROBERT-CHRISTIAN

CTO Security & Resilience at Kyndryl

Has many predefined correlation rules and is brilliant for investigation and log analysis

It is very complicated to write your own correlation rules without the help of Splunk support. What Splunk could do better is to create an API to the standard SIEM tools, such as Microsoft Sentinel. The idea would be to make it less painful. In ELK Stack, Kibana is the query language with which you can search log files. I believe Splunk has also a query language in which they search their log files, but once you have identified the log file that you want to use for further security correlation, you want to very quickly transport that into your SIEM tool, such as Microsoft Sentinel. That is something that Splunk could make a little bit less painful because it is a lot of effort to find that log file and forward it. An API with Microsoft Sentinel or a similar SIEM tool would be a good idea.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Incident management is its most valuable feature."

"The newer 11.5 version that my team is using has found it to have good mapping."

"The most valuable feature is the hunting ability to work in a CERT."

"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."

"The most valuable features are the packet decoder, log decoder, and concentrator."

"It's fully scalable. There is no limit. Of course, the license limits per day the number of terabytes. In my opinion, it's very flexible."

"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."

"The most valuable features are the threat prediction and network forensics."

More NetWitness Platform pros

"The breadth of the data sources that Splunk can ingest data from is broad and deep and it does an exemplary job at handling structured data."

"We can easily configure things as required in relation to our use cases."

"It is a one stop shop as a full monitoring and alerting solution for operations and application analysis for most of our back-end systems."

"The product provides visibility and enables us to correlate data and generate alerts."

"Aggregation searches have reduced time and difficulty of identifying trends and conditions which need to reviewed."

"We can extract the metrics we want on the dashboards. We are able to react to the incidents."

"I am enjoying our implementation of risk-based alerting. That has helped very much with cutting out a lot of the noise that we have. It has reduced our alert volume significantly. There is about an 80% reduction."

"It provides logs in one place, so they are easy to find. It collects the logs from multiple places, then you have just one place where you see the whole flow from the front-end to the back-end."

More Splunk Enterprise Security pros

Cons

"I believe that integrating the solution with other products such as Oracle would be beneficial."

"Its technical support could be better."

"Security needs improvement."

"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."

"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."

"Health monitoring of the event sources and devices."

"The initial setup is complex. There are other solutions that are easier to implement."

"The solution should have more integration capabilities with different platforms."

More NetWitness Platform cons

"Splunk isn't appropriate for smaller companies. It's too expensive."

"Splunk could improve its default machine-learning models. Also, Splunk Enterprise's native threat intelligence isn't that good. I prefer a custom threat intelligence model."

"An area of improvement would be the licensing of the solution. They need a free license, which would allow faster lead times."

"Splunk is very expensive. The license is based on the volume of the logs ingested. I was responsible for managing the contract with our service integrator. I don't know the precise details of the competing solution, but I have heard that Splunk is more expensive than others. I don't know what the going rate is on the market, but I think there are at least two competitors that are less expensive. We have experienced a few issues with our service providers in terms of log filtering and ingestion, so we continue to pay a bit more per day for our logs."

"The threat detection system has room for improvement."

"It would be nice if Splunk reduced the cost of training. Their training sessions are way too costly."

"Splunk could have more built-in use case presets that customers can build on and customize."

"It works as intended for us, and we are getting everything that we need out of it. If anything, its initial setup can be improved a bit."

More Splunk Enterprise Security cons

Pricing and Cost Advice

"The licenses are good but the cost is very expensive."

"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."

"The tool is very expensive, so I rate the pricing a ten out of ten. The solution has an annual subscription."

"The product price was reasonable for my region and the market."

"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."

"It’s cheaper to run virtual machines in a VMware environment."

"We are on an annual license for the use of the solution."

"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."

More NetWitness Platform pricing and cost advice

"I believe that Splunk Enterprise Security is worth the price, but it is expensive."

"My customers have found the price of the solution to be high."

"The pricing can be better. We are already considering Elastic because Splunk is too expensive. You have to pay based on per-day ingestion. There should be a more flexible model for the use cases where one day you have a huge amount, and on other days, it is quite less."

"Splunk Enterprise Security incurs a significant cost because of the amount of data we send, but we are fine with the value we're getting for that price."

"Although Splunk is an expensive product, it is designed to be utilized across your organization in order to maximize your ROI and lower your TCO."

"Splunk is definitely not a cheap solution. It is an expensive product."

"Splunk Enterprise Security is expensive."

"Price-wise, if you compare QRadar to Splunk for SIEM functionality then they are in the same range but when you integrate SOAR with these solutions, Splunk takes the lead and is more competitive."

More Splunk Enterprise Security pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

845,040 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at Deloitte & Touche

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

18%

Computer Software Company

17%

Government

Insurance Company

Financial Services Firm

15%

Computer Software Company

14%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

What is your experience regarding pricing and costs for NetWitness Platform?

The product price was reasonable for my region and the market.

What needs improvement with NetWitness Platform?

From an improvement perspective, the NetWitness Platform needs to release new features and improve in areas like log correlation. The tool needs to have easier integrations with the cloud. Building...

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

How does Splunk compare with Azure Monitor?

Splunk handles a high amount of data very well. We use Splunk to capture information and as an aggregator for monitoring information from different sources. Splunk is very good at alerting us if we...

IBM Security QRadar vs NetWitness Platform

Comparisons

Compared 20% of the time

RSA enVision vs NetWitness Platform

Compared 12% of the time

Elastic Security vs NetWitness Platform

Compared 10% of the time

Trellix Network Detection and Response vs NetWitness Platform

Compared 10% of the time

Cisco Secure Network Analytics vs NetWitness Platform

Compared 10% of the time

More NetWitness Platform Competitors

Wazuh vs Splunk Enterprise Security

Compared 9% of the time

IBM Security QRadar vs Splunk Enterprise Security

Compared 9% of the time

Dynatrace vs Splunk Enterprise Security

Compared 8% of the time

Datadog vs Splunk Enterprise Security

Compared 5% of the time

Sentinel vs Splunk Enterprise Security

Compared 4% of the time

More Splunk Enterprise Security Competitors

Product Reports

NetWitness Platform

Download NetWitness Platform product report

Splunk Enterprise Security

Download Splunk Enterprise Security product report

Also Known As

RSA Security Analytics

No data available

Overview

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Splunk Enterprise Security is widely used for security operations, including threat detection, incident response, and log monitoring. It centralizes log management, offers security analytics, and ensures compliance, enhancing the overall security posture of organizations.

Companies leverage Splunk Enterprise Security to monitor endpoints, networks, and users, detecting anomalies, brute force attacks, and unauthorized access. They use it for fraud detection, machine learning, and real-time alerts within their SOCs. The platform enhances visibility and correlates data from multiple sources to identify security threats efficiently. Key features include comprehensive dashboards, excellent reporting capabilities, robust log aggregation, and flexible data ingestion. Users appreciate its SIEM capabilities, threat intelligence, risk-based alerting, and correlation searches. Highly scalable and stable, it suits multi-cloud environments, reducing alert volumes and speeding up investigations.

What are the key features?

Comprehensive Dashboards: Provide a holistic view of security operations.
Flexible Data Ingestion: Supports various data sources for better analysis.
Robust Log Aggregation: Centralizes log management for easier monitoring.
Machine Learning Toolkit: Enhances threat detection and prediction capabilities.
SIEM Capabilities: Integrates security information and event management.
Threat Intelligence: Utilizes external information to improve security measures.
Risk-Based Alerting: Prioritizes alerts based on the risk they pose.
Correlation Searches: Identifies and correlates security events effectively.

What benefits or ROI should users look for?

Enhanced Visibility: Improves monitoring across endpoints, networks, and users.
Faster Incident Response: Speeds up identification and resolution of security issues.
Reduced Alert Volumes: Lowers false positives and enhances signal-to-noise ratio.
Scalability: Adapts to growing and changing security needs.
Improved Security Operations: Integrates multiple security facets into one platform.

Splunk Enterprise Security is implemented across industries like finance, healthcare, and retail. Financial institutions use it for fraud detection and compliance, while healthcare organizations leverage its capabilities to safeguard patient data. Retailers deploy it to protect customer information and ensure secure transactions.

Splunk

Sample Customers

Los Angeles World Airports, Reply

Splunk has more than 7,000 customers spread across over 90 countries. These customers include Telenor, UniCredit, ideeli, McKenney's, Tesco, and SurveyMonkey.

NetWitness Platform vs. Splunk Enterprise Security