We performed a comparison between NetWitness Platform and Trellix ESM based on real PeerSpot user reviews.
Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The product's initial setup phase was not at all difficult."
"The development of use cases on the SSA console is quite user friendly. This means that the security analyst or the researcher does not have to learn another language."
"The most valuable features are the threat prediction and network forensics."
"The product has a user-friendly interface and a valuable feature for threat intelligence integration."
"The most valuable features are its ingestion of logs and raising of alerts based on those logs."
"The most valuable feature is the hunting ability to work in a CERT."
"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."
"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."
"It has performed well and delivered the results that I have been looking for."
"Trellix ESM is very user-friendly."
"I like the ease of deployment."
"The most valuable feature is that if the scanning does find something, it quarantines it. Then you can decide what you are going to do with it."
"It enables us to detect malicious threats, issues, or vulnerabilities in our network."
"This solution integrates easily and very well with other technologies."
"McAfee as a whole is a good solution."
"It is user-friendly. The notification part of McAfee ESM is very easy."
"The solution should have more integration capabilities with different platforms."
"The product's licensing models are complex to understand. This particular area needs improvement."
"Security needs improvement."
"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."
"The implementation needs assistance."
"More customizability is required, which is something that they need to improve on."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."
"Customized reports and alerting functionality could be included in the dashboard."
"I would like to see improvements to the user interface."
"I would like to see fingerprint recognition included in the next release of this solution."
"Cloud integration has room for improvement because they're not full-fledged to integrate with the cloud solutions that come. They use different integration platforms to bring in data, and that needs to be improved."
"Update to user interface from version 9 is cosmetic in some aspects, and after a few clicks you are back on the old interface."
"The disk space needed for events is not clear. In all clients, we had at least more than 100GB free that we could not use."
"The only drawback is that they don't have any packet capturing or network behavior analysis."
"The solution needs to improve case management. The UI is confusing."
NetWitness Platform is ranked 15th in Security Information and Event Management (SIEM) with 36 reviews while Trellix ESM is ranked 19th in Security Information and Event Management (SIEM) with 34 reviews. NetWitness Platform is rated 7.4, while Trellix ESM is rated 7.4. The top reviewer of NetWitness Platform writes "Can find out if there is lateral movement, but integration and workflow need improvement". On the other hand, the top reviewer of Trellix ESM writes "Provides visibility of all the traffic within the company infrastructure". NetWitness Platform is most compared with Splunk Enterprise Security, RSA enVision, IBM Security QRadar, Cisco Secure Network Analytics and Microsoft Sentinel, whereas Trellix ESM is most compared with ArcSight Enterprise Security Manager (ESM), IBM Security QRadar, Splunk Enterprise Security, LogRhythm SIEM and Trellix Helix. See our NetWitness Platform vs. Trellix ESM report.
See our list of best Security Information and Event Management (SIEM) vendors.
We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
