ArcSight Logger vs NetWitness Platform comparison

OpenText and NetWitness are both solutions in the Log Management category. OpenText is ranked #45 with an average rating of 6.8, while NetWitness is ranked #34 with an average rating of 8.3. OpenText holds a 0.9% mindshare in Log Management, compared to NetWitness’s 0.8% mindshare. Additionally, 81% of OpenText users are willing to recommend the solution, compared to 75% of NetWitness users who would recommend it.

ArcSight Logger

Read 32 ArcSight Logger reviews

1,701 Views
1,684 Comparison Views

81% willing to recommend

NetWitness Platform

Read 36 NetWitness Platform reviews

2,362 Views
1,252 Comparison Views

75% willing to recommend

ArcSight Logger

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 9, 2024

NetWitness Platform and ArcSight Logger compete in security information and event management. While NetWitness Platform is more appealing in pricing and support, ArcSight Logger is preferred for its features despite its higher cost.

Features: NetWitness Platform stands out with analytics-driven threat detection, seamless integration capabilities, and robust security measures. ArcSight Logger impresses with its scalability, extensive log management, and ability to handle large data volumes efficiently.

Room for Improvement: NetWitness Platform users note the need for a streamlined workflow, enhanced real-time alerting, and improved user interface. ArcSight Logger would benefit from better search functionalities, refined reporting capabilities, and a less complex user experience.

Ease of Deployment and Customer Service: NetWitness Platform offers a straightforward deployment process with a responsive support team. In contrast, ArcSight Logger's deployment is more complex, but the customer service team excels in problem-solving expertise once operational.

Pricing and ROI: NetWitness Platform is more cost-effective initially, offering a quicker ROI due to lower setup costs. ArcSight Logger, despite higher upfront expenses, is valued for its long-term benefits and robust security features, leading to a favorable ROI in demanding data environments.

To learn more, read our detailed ArcSight Logger vs. NetWitness Platform Report (Updated: March 2026).

Buyer's Guide

ArcSight Logger vs. NetWitness Platform

March 2026

Download the complete report

Helped 884,873 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

ArcSight Logger

Ranking in Log Management

45th

Average Rating

7.6

Reviews Sentiment

5.8

Number of Reviews

Ranking in other categories

No ranking in other categories

NetWitness Platform

Ranking in Log Management

34th

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (33rd)

Mindshare comparison

As of March 2026, in the Log Management category, the mindshare of ArcSight Logger is 0.9%, up from 0.8% compared to the previous year. The mindshare of NetWitness Platform is 0.8%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management Mindshare Distribution
Product	Mindshare (%)
NetWitness Platform	0.8%
ArcSight Logger	0.9%
Other	98.3%

Log Management

Featured Reviews

Mohammed Shoaib Abdulla

Sr. Cybersecurity Consultant IT/OT at EJADA

Compliance and cost-effectiveness have improved while critical infrastructure security adapts to evolving needs

ArcSight Logger fulfills compliance requirements and passes audit requirements. It is one of the Aramco standards requirements and is recommended by Aramco for any implementation. Aramco, SABIC, water companies, and electricity companies are critical infrastructure with air-gapped networks. In an air-gapped network, there is no communication going out from that network area to the outside world, even to the corporate network. ArcSight Logger is installed on minimal resources with minimal requirements. There are not many upgrades or new features that come up frequently, though they do occur occasionally.

Read full review

MOTASHIM Al Razi

CISO at One Bank Limited

It is a stable solution, but they should make the user interface easier to understand

The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The technical support team is good...It is a scalable solution."

"The ability to customize the solution in great detail is its most valuable features. We can customize the use cases and also have the ability to do scripting. We can personalize our dashboard as well. The scalability the solution offers is quite impressive."

"The ESM use cases are the most valuable. It enables us to use the big data collection inside our company. We are able to create use cases for whatever it suits and I find that the most interesting part of any SIEM solution."

"Our return on investment for implementing ArcSight Logger over the past 12 months has been positive."

"We check a lot of logs in ArcSight Logger because we're running a massive database platform."

"Some of the most valuable features I really appreciate are the performance, how quick the solution is, and how easy it is to create a query."

"ArcSight provides the basic information that we want."

"The most valuable feature is the search capability, which is simple to use."

More ArcSight Logger pros

"The product's initial setup phase was not at all difficult."

"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."

"The product has a user-friendly interface and a valuable feature for threat intelligence integration."

"Offers a good wireless feature."

"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."

"The most valuable features are the integration and ease of use."

"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."

"It's quite economical compared to other solutions in the market."

More NetWitness Platform pros

Cons

"We find that the search and access functionality is quite slow."

"They are migrating to Splunk because ArcSight Logger doesn't have those features for user or customer behavior analysis."

"The console in older versions is not user-friendly."

"It's not a new product and is a bit complex. So, it requires a person dedicated to working on it and to know about it in and out. It is a huge product, and the search operation is a bit complicated for a new user or someone who has not used it for long. So for that person, it becomes a bit difficult."

"The integration with other systems could be improved."

"The solution could be improved in maintenance settings."

"ArcSight has been sold two or three times, and the quality has decreased."

"I would like to see better scheduling in the next release of this solution."

More ArcSight Logger cons

"The multi-tenant capabilities are lagging compared to IBM QRadar."

"Health monitoring of the event sources and devices."

"Nowadays, their support is a little subpar compared to other solutions. I rate RSA support six out of 10."

"The documentation is not as structured as I would like, personally, and I think that it can be improved and made much more user-friendly."

"An area for improvement would be better automation and more inbuilt use cases."

"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."

"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."

"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."

More NetWitness Platform cons

Pricing and Cost Advice

"It's not cheap at all as it's a big product and has been in the market for quite some time now."

"Pricing is reasonable compared to similar tools on the market. They offer perpetual licenses."

"The pricing is quite harsh."

"I rate the product’s pricing a seven out of ten, where one is inexpensive, and ten is expensive."

"ArcSight is an expensive solution."

"ArcSight Logger is very expensive compared to their competitors, but when we talk to the customer and explain what the features are and how we can scale, they understand. Still, ArcSight is more expensive than the competition."

"We have a lifetime license, so we don't pay a monthly fee."

"I would rate the product a seven out of ten since it's an enterprise product."

"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."

"It’s cheaper to run virtual machines in a VMware environment."

"It provides tools to assist in selecting the appropriate license and usage scenarios."

"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."

"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."

"The product is expensive."

"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."

"The licenses are good but the cost is very expensive."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

884,873 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

11%

Computer Software Company

Marketing Services Firm

Comms Service Provider

Financial Services Firm

11%

Performing Arts

Computer Software Company

Marketing Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	10
Large Enterprise	16

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	7
Large Enterprise	20

Questions from the Community

What do you like most about ArcSight Logger?

We have a trigger. So, Logger automatically blocks these IP addresses. We could have Logger put them on a blacklist.

See all answers

What is your experience regarding pricing and costs for ArcSight Logger?

The pricing isn't the problem. We have a lifetime license, so we don't pay a monthly fee.

See all answers

What needs improvement with ArcSight Logger?

This decision is made by higher management as they don't want to have multiple solutions for one solution. ArcSight Logger themselves don't provide good support, but companies such as ours provide ...

See all answers

What do you like most about NetWitness Platform?

The product's initial setup phase was not at all difficult.

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

See all answers

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

See all answers

Comparisons

Splunk Enterprise Security vs ArcSight Logger

Compared 18% of the time

IBM Security QRadar vs ArcSight Logger

Compared 16% of the time

Elastic Security vs ArcSight Logger

Compared 9% of the time

LogRhythm SIEM vs ArcSight Logger

Compared 7% of the time

LogLogic vs ArcSight Logger

Compared 5% of the time

More ArcSight Logger Competitors

IBM Security QRadar vs NetWitness Platform

Compared 8% of the time

Splunk Enterprise Security vs NetWitness Platform

Compared 6% of the time

Elastic Security vs NetWitness Platform

Compared 5% of the time

Sumo Logic Security vs NetWitness Platform

Compared 4% of the time

RSA enVision vs NetWitness Platform

Compared 3% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

ArcSight Logger

March 2026

Download ArcSight Logger product report

Buyer's Guide

NetWitness Platform

March 2026

Download NetWitness Platform product report

Also Known As

Micro Focus Arcsight Logger, HPE Arcsight Logger

RSA Security Analytics

Overview

HPE ArcSight Data Platform (ADP) offers a future-ready data solution that enriches data in real time and supports open standards for better threat detection. Using security data connectors, ADP collects data and enriches it in real-time to give analysts organized information that can be acted upon instantly.

OpenText

NetWitness Platform is an evolved SIEM and threat detection and response solution that functions as a single, unified platform for ALL your security data. It features an advanced analyst workbench for triaging alerts and incidents, and it orchestrates security operations programs end to end. In short: NetWitness Platform is all you need to run an intelligent SOC.

NetWitness

Sample Customers

China Merchants Bank, Bank AlJazira, Banca Intesa

Los Angeles World Airports, Reply

Buyer's Guide

ArcSight Logger vs. NetWitness Platform

March 2026

Free Report: ArcSight Logger vs. NetWitness Platform

Find out what your peers are saying about ArcSight Logger vs. NetWitness Platform and other solutions. Updated: March 2026.

DOWNLOAD NOW

884,873 professionals have used our research since 2012.

See our ArcSight Logger vs. NetWitness Platform report.

See our list of best Log Management vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.