NetWitness Platform vs Snare comparison

Cancel
You must select at least 2 products to compare!
Microsoft Logo
33,792 views|18,846 comparisons
NetWitness Logo
1,261 views|770 comparisons
Intersect Alliance Logo
860 views|619 comparisons
Comparison Buyer's Guide
Executive Summary

We performed a comparison between NetWitness Platform and Snare based on real PeerSpot user reviews.

Find out in this report how the two Log Management solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed NetWitness Platform vs. Snare Report (Updated: March 2024).
765,234 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"What is most useful, is that it has a good connection to the Microsoft ecosystem, and I think that's the key part.""The part that was very unexpected was Sentinel's ability to integrate with Azure Lighthouse, which, as a managed services solution provider, gives us the ability to also manage our customers' Sentinel environments or Sentinel workspaces. It is a big plus for us. With its integration with Lighthouse, we get the ability to monitor multiple workspaces from one portal. A lot of the Microsoft Sentinel workbooks already integrate with that capability, and we save countless amounts of money by simply being able to almost immediately realize multitenant capabilities. That alone is a big plus for us.""The UI of Sentinel is very good and easy to use, even for beginners.""Microsoft Sentinel provides the capability to integrate different log sources. On top of having several data connectors in place, you can also do integration with a threat intelligence platform to enhance and enrich the data that's available. You can collect as many logs and build all the use cases.""The solution offers a lot of data on events. It helps us create specific detection strategies.""It's pretty powerful and its performance is pretty good.""The automation rules and playbooks are the most useful that I've seen. A number of other places segregate the automation and playbook as separate tools, whereas Microsoft is a SIEM and SOAR tool in one.""Sentinel is a SIEM and SOAR tool, so its automation is the best feature; we can reduce human interaction, freeing up our human resources."

More Microsoft Sentinel Pros →

"It's quite economical compared to other solutions in the market.""The product has a user-friendly interface and a valuable feature for threat intelligence integration.""Performance and reporting are very good.""It gives the ability to investigate into network traffic in the Net and the organization what we couldn't do before.""The most valuable features are its ingestion of logs and raising of alerts based on those logs.""NetWitness Platform is valuable for creating rules that the solution must detect.""The most valuable feature is the correlation. It can report in real-time and monitor the management.""The packet capture aspect of it is a valuable feature because it is quite different from a traditional SIEM solution that only carries out investigations based on captured logs."

More NetWitness Platform Pros →

"Snare has good agents, especially for Windows.""The most valuable feature of Snare is flexibility or the ability to filter all things you don't want and don't have security value.""The best thing about Snare is its format and consistency."

More Snare Pros →

Cons
"Microsoft Defender has a built-in threat expert option that enables you to contact an expert. That feature isn't available in Sentinel because it's a huge product that integrates all the technologies. I would like Microsoft to add the threat expert option so we can contact them. There are a few other features, like threat assessment that the PG team is working on. I expect them to release this feature in the next quarter.""If Azure Sentinel had the ability to ingest Azure services from different tenants into another tenant that was hosting Azure Sentinel, and not lose any metadata, that would be a huge benefit to a lot of companies.""Sentinel's alerts and notifications are not fully optimized for mobile devices. The overall reporting and the analytics processes for the end user should also be improved. Also, the compatibility and availability of data sources and reports are not always perfect.""When we pass KPIs to the governance department, there's no option to provide rights to the data or dashboard to colleagues. We can use Power BI for this, but it isn't easy or convenient. They should just come up with a way to provide limited role-based access to auditing personnel""Azure Sentinel will be directly competing with tools such as Splunk or Qradar. These are very established kinds of a product that have been around for the last seven, eight years or more.""If I can use Sentinel offline at home and use it on a local network, it would be great. I'm not sure if I can use Sentinel offline versus the tools I have.""They're giving us the queries so we can plug them right into Sentinel. They need to have a streamlined process for updating them in the tool and knowing when things are updated and knowing when there are new detections available from Microsoft.""They should just add more and more out-of-the-box connectors. It is quite a new product, and it has a lot of connectors, and even more would be good."

More Microsoft Sentinel Cons →

"Log aggregation is an issue with this solution because there are a huge number of alerts in a single instance.""Its technical support could be better.""More customizability is required, which is something that they need to improve on.""I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex.""There are instances where you try to run the reports and then it does not give you the desired outcome.""Health monitoring of the event sources and devices.""I believe that integrating the solution with other products such as Oracle would be beneficial.""It is not so easy to customize this product."

More NetWitness Platform Cons →

"Snare should modernize its GUI a little bit.""The solution is now developing a SIEM-like feature on Snare Central Server, but it's not complete yet.""Users will initially find it difficult to identify the event types and installation in Snare."

More Snare Cons →

Pricing and Cost Advice
  • "It comes with a Microsoft subscription which the customer has, so they don't have to invest somewhere else."
  • "It is a consumption-based license model. bands at 100, 200, 400 GB per day etc. Azure Sentinel Pricing | Microsoft Azure"
  • "Good monthly operational cost model for the detection and response outcomes delivered, M365 logs don't count toward the limits which is a good benefit."
  • "I have had mixed feedback. At one point, I heard a client say that it sometimes seems more expensive. Most of the clients are on Office 365 or M365, and they are forced to take Azure SIEM because of the integration."
  • "It is kind of like a sliding scale. There are different tiers of pricing that go from $100 per day up to $3,500 per day. So, it just kind of depends on how much data is being stored. There can be additional costs to the standard license other than the additional data. It just kind of depends on what other services you're spinning up in Azure, or if you're using something like Azure log analytics."
  • "I am just paying for the log space with Azure Sentinel. It costs us about $2,000 a month. Most of the logs are free. We are only paying money for Azure Firewall logs because email logs or Azure AD logs are free to use for us."
  • "Sentinel is a bit expensive. If you can figure a way of configuring it to meet your needs, then you can find a way around the cost."
  • "Azure Sentinel is very costly, or at least it appears to be very costly. The costs vary based on your ingestion and your retention charges."
  • More Microsoft Sentinel Pricing and Cost Advice →

  • "It’s cheaper to run virtual machines in a VMware environment."
  • "The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."
  • "It is cheap."
  • "The licenses are good but the cost is very expensive."
  • "This is a pricey solution; it's not cheap."
  • "We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
  • "Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
  • "Our license is for one year."
  • More NetWitness Platform Pricing and Cost Advice →

  • "Snare has reasonable pricing."
  • "On a scale from one to ten, where one is cheap, and ten is expensive, I rate Snare's pricing a four out of ten."
  • "Snare is a cheap solution because a lot of customers are using it."
  • More Snare Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Log Management solutions are best for your needs.
    765,234 professionals have used our research since 2012.
    Comparison Review
    Vinod Shankar
    Questions from the Community
    Top Answer:Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and… more »
    Top Answer:It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for… more »
    Top Answer:We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is… more »
    Top Answer:The product has a user-friendly interface and a valuable feature for threat intelligence integration.
    Top Answer:The product is expensive. I rate its pricing a seven out of ten.
    Top Answer:It is quite tedious to make changes in the playbooks. There could be an option to integrate or adapt AI and machine… more »
    Top Answer:The best thing about Snare is its format and consistency.
    Top Answer:Snare is a cheap solution because a lot of customers are using it.
    Top Answer:Users will initially find it difficult to identify the event types and installation in Snare.
    Comparisons
    Also Known As
    Azure Sentinel
    RSA Security Analytics
    Learn More
    Overview

    Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

    - Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

    - Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

    - Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

    - Respond to incidents rapidly with built-in orchestration and automation of common tasks

    To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

    NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

    Snare customers consistently tell us that as the financial and reputational consequences of data breaches, cyber threats like malware and ransomware and the constant risks from insider threats increase that they have urgent and ongoing requirements for maintaining regulatory compliance, auditing and managing cyber threat detection and response. They also tell us that existing solutions like SIEM are often complex to implement and maintain, require specialised technical resources or are increasingly unaffordable or variable in their pricing. As a result of these increased requirements Prophecy International has created the Snare product suite.

    Compliance requirements can include any number of regulatory mandates including PCI-DSS, Sarbanes Oxley, HIPAA, NERC, GDPR and more. This makes Snare a high value solution for companies in the Government, Defence and Military sectors, Banking, Finance and Insurance, Retail, Health, Energy, Oil & Gas markets.

    Snare is a complete suite of Centralised Log Management (CLM), Security Analytics and SIEM tools.

    Created by ex military personnel for military use it offers the highest level of security.

    Designed to work as part of your security ecosystem Snare also integrates with most other SIEMs including SPLUNK, QRadar, ARCSight and many more. With over 3,000 customers worldwide using Snare for compliance, auditing and threat response, Snare is the name you can trust.

    From Enterprise Agents for Windows, Unix, Linux, OSX, Flat files and Databases to a complete forensics and long term log storage platform, agent management console, multipoint log reflector, advanced log analytics and next gen SIEM capability. Either hosted or on prem with both Opex and Capex pricing models, Snare is a one stop shop for CLM and SIEM. Snare product suite is broadly split into two areas:

    • Centralised Log Management and Snare Analytics

    Centralised Log Management incorporates and 4 core technologies

    • Snare Enterprise Agents
    • Snare Reflector
    • Snare Agent Management Console
    • Snare Central Service

    Snare Analytics incorporates another 4 core technologies

    • Enhanced Snare Central Server incorporating Analytics
    • Data Ingestion Technologies (via our Adaptors)
    • Dashboards and Visualisations including custom KPI engine
    • Runbook – enabling SOAR

    These products can be bought independently or combined into a compete solution. You can also “mix and match” with your current security technologies ensuring that you can leverage your existing investments.

    Sample Customers
    Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
    Los Angeles World Airports, Reply
    Military, Defence and Security Agencies, Banking Finance and Insurance companies, Retail, Health and Utilities.
    Top Industries
    REVIEWERS
    Financial Services Firm22%
    Computer Software Company11%
    Manufacturing Company8%
    Comms Service Provider8%
    VISITORS READING REVIEWS
    Computer Software Company16%
    Financial Services Firm10%
    Government9%
    Manufacturing Company7%
    REVIEWERS
    Financial Services Firm24%
    Computer Software Company24%
    Comms Service Provider24%
    Manufacturing Company10%
    VISITORS READING REVIEWS
    Financial Services Firm15%
    Computer Software Company15%
    Government10%
    Insurance Company6%
    VISITORS READING REVIEWS
    Government15%
    Computer Software Company13%
    Financial Services Firm12%
    Manufacturing Company11%
    Company Size
    REVIEWERS
    Small Business33%
    Midsize Enterprise21%
    Large Enterprise47%
    VISITORS READING REVIEWS
    Small Business25%
    Midsize Enterprise16%
    Large Enterprise60%
    REVIEWERS
    Small Business26%
    Midsize Enterprise17%
    Large Enterprise57%
    VISITORS READING REVIEWS
    Small Business22%
    Midsize Enterprise10%
    Large Enterprise68%
    VISITORS READING REVIEWS
    Small Business20%
    Midsize Enterprise7%
    Large Enterprise73%
    Buyer's Guide
    NetWitness Platform vs. Snare
    March 2024
    Find out what your peers are saying about NetWitness Platform vs. Snare and other solutions. Updated: March 2024.
    765,234 professionals have used our research since 2012.

    NetWitness Platform is ranked 30th in Log Management with 35 reviews while Snare is ranked 41st in Log Management with 3 reviews. NetWitness Platform is rated 7.4, while Snare is rated 8.0. The top reviewer of NetWitness Platform writes "Can find out if there is lateral movement, but integration and workflow need improvement". On the other hand, the top reviewer of Snare writes "A highly scalable solution that is easy to manage and super easy to set up". NetWitness Platform is most compared with Splunk Enterprise Security, RSA enVision, IBM Security QRadar, Cisco Secure Network Analytics and Trellix Network Detection and Response, whereas Snare is most compared with syslog-ng, Splunk Enterprise Security, SolarWinds Kiwi Syslog Server, LogRhythm SIEM and Elastic Security. See our NetWitness Platform vs. Snare report.

    See our list of best Log Management vendors and best Security Information and Event Management (SIEM) vendors.

    We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.