Devo vs NetWitness Platform comparison

Devo and NetWitness are both solutions in the Log Management category. Devo is ranked #18 with an average rating of 8.3, while NetWitness is ranked #37 with an average rating of 8.0. Devo holds a 1.4% mindshare in Log Management, compared to NetWitness’s 1.1% mindshare. Additionally, 92% of Devo users are willing to recommend the solution, compared to 75% of NetWitness users who would recommend it.

Devo

Read 26 Devo reviews

6,972 Views
3,625 Comparison Views

92% willing to recommend

NetWitness Platform

Read 36 NetWitness Platform reviews

5,586 Views
2,681 Comparison Views

75% willing to recommend

Devo

NetWitness Platform

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 3, 2026

NetWitness Platform and Devo are competing products in the cybersecurity solutions category. Devo seems to have the upper hand due to its integration capabilities and scalability benefits.

Features: NetWitness Platform provides advanced threat detection, incident response, and rule creation for security events. Devo focuses on real-time data analytics, ease of integration, and Activeboards for custom dashboards.

Room for Improvement: NetWitness could improve on simplifying its deployment model, enhancing user interface intuitiveness, and reducing initial setup time. Devo could benefit from expanding its real-time alerting capabilities, providing more intuitive navigation in its interface, and lower costs for licensing and long-term data retention.

Ease of Deployment and Customer Service: NetWitness Platform requires substantial initial setup due to its complex deployment model, whereas Devo offers a streamlined, cloud-based deployment, minimizing setup complexity. While NetWitness provides robust customer service, Devo’s customer support is noted for faster issue resolution and onboarding.

Pricing and ROI: NetWitness Platform generally involves higher setup costs with complex licensing models, but it provides ROI through intelligence-driven security solutions. Devo offers a more cost-effective solution with lower initial costs, delivering substantial ROI through rapid deployment and high-value data analytics. Devo provides a more accessible entry point while maintaining functionality, in contrast to NetWitness, which is favored by organizations seeking comprehensive on-premise solutions.

To learn more, read our detailed Devo vs. NetWitness Platform Report (Updated: August 2026).

Buyer's Guide

Devo vs. NetWitness Platform

August 2026

Download the complete report

Helped 908,877 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Devo

Ranking in Log Management

18th

Ranking in Security Information and Event Management (SIEM)

18th

Average Rating

8.4

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

IT Operations Analytics (7th), AIOps (13th)

NetWitness Platform

Ranking in Log Management

37th

Ranking in Security Information and Event Management (SIEM)

36th

Average Rating

7.4

Reviews Sentiment

7.4

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of August 2026, in the Log Management category, the mindshare of Devo is 1.4%, up from 0.6% compared to the previous year. The mindshare of NetWitness Platform is 1.1%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Log Management Mindshare Distribution
Product	Mindshare (%)
Devo	1.4%
NetWitness Platform	1.1%
Other	97.5%

Log Management

Featured Reviews

Usama Khan

Team Lead SOC at a tech services company with 51-200 employees

Advanced threat hunting has improved SOC visibility and now supports faster incident response

Devo can improve in how its connectors enhance integration with third-party tools. Devo's architecture works by having you deploy a relay server in the data center of the client side and Devo SIEM is basically on the AWS cloud. There are specific ports which are enabled on the relay server, which are 514 and 13000, 13151, 152. However, when we talk about databases and custom integrations, there are not default ports in the relay server. No default ports are defined. For JDBC drivers, the port number is 1433, but it is not in the relay server. You have to add it manually. For Oracle RDBMS, the port is 1521, and it is also not there by default. I would appreciate more third-party integrations including Fortinet and others. Machine learning models can also be improved. Playbooks in the SOAR can also be improved. Regarding playbooks for automation, we utilize playbooks for automation in SOAR for automated IOC blocking on a firewall, on a web application firewall, on DNS security, etc. The only option for us to run the playbook is to schedule the job for it. However, if I want to manually run the playbook, there is no option for doing so. This needs improvement.

Read full review

reviewer2256927

Head of Information Security, Cyber Defense and IT Risk Management at HCT. at a transportation company with 201-500 employees

A solid SIEM solution that should improve technical support and online resources to be easier to use

A big problem with the product is that we don't have much professional experience in Israel installing, implementing, and integrating this product. There is not enough of a knowledge base. There is no support for this product in this country, so problems have to be resolved through global technical teams. We like to work locally because of the language, and when the product is only supported outside the country, it's a little difficult to implement and use this product. Moreover, AI is something that must be added immediately. Artificial intelligence is a part of the competitors' products, and it's not been implemented for us.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The user experience [is] well thought out and the workflows are logical. The dashboards are intuitive and highly customizable."

"I'm so happy with the platform."

"The thing that Devo does better than other solutions is to give me the ability to write queries that look at multiple data sources and run fast. Most SIEMs don't do that. And I can do that by creating entity-based queries. Let's say I have a table which has Okta, a table which has G Suite, a table which has endpoint telemetry, and I have a table which has DNS telemetry. I can write a query that says, 'Join all these things together on IP, and where the IP matches in all these tables, return to me that subset of data, within these time windows.' I can break it down that way."

"It centralizes security management within a business, functioning as a core system for a SOC."

"In traditional BI solutions, you need to wait a lot of time to have the ability to create visualizations with the data and to do searches. With this kind of platform, you have that information in real-time."

"Overall, using Devo has saved us time when compared to our previous security solutions, and I estimate that it took us 10 times longer to achieve the same thing without Devo."

"The strength of Devo is not only in that it is pretty intuitive, but it gives you the flexibility and creativity to merge feeds. The prime examples would be using the synthesis or union tables that give you phenomenal capabilities... The ability to use a synthesis or union table to combine all those feeds and make heads or tails of what's going on, and link it to go down a thread, is functionality that I hadn't seen before."

"It's very, very versatile."

More Devo pros

"The newer 11.5 version that my team is using has found it to have good mapping."

"It gives customers visibility about their most important servers and devices."

"The solution is reliable."

"Performance and reporting are very good."

"NetWitness Platform is valuable for creating rules that the solution must detect."

"Over time, NetWitness Logs and Packets has matured from a boxed solution with multiple parts to the current, more streamlined version for which we only need the software license to put it up on our own cloud and deliver it to multiple clients."

"The most valuable features are the threat prediction and network forensics."

"The product's initial setup phase was not at all difficult."

More NetWitness Platform pros

Cons

"We only use the core functionality and one of the reasons for this is that their security operation center needs improvement."

"Both response time and support quality need attention."

"Some basic reporting mechanisms have room for improvement."

"It's stable but it's not extremely stable."

"However, the incident and threat detection is not what we had hoped for."

"From our experience, the Devo agent needs some work. They built it on top of OS Query's open-source framework. It seems like it wasn't tuned properly to handle a large volume of Windows event logs. In our experience, there would definitely be some room for improvement. A lot of SIEMs on the market have their own agent infrastructure. I think Devo's working towards that, but I think that it needs some improvement as far as keeping up with high-volume environments."

"There are some issues from an availability and functionality standpoint, meaning the tool is somewhat slow. There were some slow response periods over the past six to nine months, though it has yet to impact us terribly as we are a relatively small shop. We've noticed it, however, so Devo could improve the responsiveness."

"The cost is a little higher compared to other tools such as DataDog or Elasticsearch, so they could work on reducing costs."

More Devo cons

"If we have the ability to run a dynamic analysis through malware in the same suite, it would be great to have a sandbox solution to analyze malware through dynamic analysis."

"Security needs improvement."

"The documentation is not as structured as I would like, personally, and I think that it can be improved and made much more user-friendly."

"They should implement algorithms to digest that data and produce additional, more advanced reporting, alerting and support of internal security teams."

"There is no support for this product in this country, so problems have to be resolved through global technical teams."

"We have encountered issues with unresolved crashes."

"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."

"More customizability is required, which is something that they need to improve on."

More NetWitness Platform cons

Pricing and Cost Advice

"The way Devo prices things is based on the amount of data, and I wish the tiers had more granularity. Maybe at this point they do, but when we first negotiated with them, there were only three or four tiers."

"Devo is definitely cheaper than Splunk. There's no doubt about that. The value from Devo is good. It's definitely more valuable to me than QRadar or LogRhythm or any of the old, traditional SIEMs."

"I'm not involved in the financial aspect, but I think the licensing costs are similar to other solutions. If all the solutions have a similar cost, Devo provides more for the money."

"Our licensing fees are billed annually and per terabyte."

"It's very competitive. That was also a primary draw for us. Some of the licensing models with solutions like Splunk and Sentinel were attractive upfront, but there were so many micro-charges and services we would've had to add on to make them what we wanted. We had to include things like SOAR and extended capabilities, whereas all those capabilities are completely included with the Devo platform. I haven't seen any additional fee."

"Pricing is based on the number of gigabytes of ingestion by volume, and it's on a 30-day average. If you go over one day, that's not a big deal as long as the average is what you expected it to be."

"I rate the pricing a four on a scale of one to ten, where one is cheap, and ten is expensive."

"We have an OEM agreement with Devo. It is very similar to the standard licensing agreement because we are charged in the same way as any other customer, e.g., we use the backroom."

More Devo pricing and cost advice

"It is cheap."

"Compared to the competition, the is price is not that high."

"The product is expensive."

"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."

"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."

"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."

"We are on an annual license for the use of the solution."

"It’s cheaper to run virtual machines in a VMware environment."

More NetWitness Platform pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Log Management solutions are best for your needs.

See recommendations

908,877 professionals have used our research since 2012.

Comparison Review

Vinod Shankar

Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees

Feb 26, 2015

HP ArcSight vs. IBM QRadar vs. McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm

We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…

Read full review

Top Industries

By visitors reading reviews

Financial Services Firm

15%

Construction Company

10%

Outsourcing Company

Manufacturing Company

Construction Company

13%

Financial Services Firm

11%

Comms Service Provider

Outsourcing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	10
Midsize Enterprise	5
Large Enterprise	12

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	7
Large Enterprise	20

Questions from the Community

What is your experience regarding pricing and costs for Devo?

The pricing of the product is reasonable if we compare it with other Gartner leading products like Splunk, LogRhythm, Microsoft Sentinel, Google SecOps. Its licensing model is basically on per-day ...

See all answers

What needs improvement with Devo?

See all answers

What is your primary use case for Devo?

I am using Devo myself. Basically, I work at an MSSP, and we provide services to the organization for Security Operation Centers. In our Security Operation Center, we provide the service of SIEM vi...

See all answers

What is your experience regarding pricing and costs for NetWitness Platform?

The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.

See all answers

What needs improvement with NetWitness Platform?

There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.

See all answers

What is your primary use case for NetWitness Platform?

I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.

See all answers

Comparisons

Splunk Enterprise Security vs Devo

Compared 8% of the time

LogRhythm SIEM vs Devo

Compared 7% of the time

New Relic vs Devo

Compared 4% of the time

IBM Security QRadar vs Devo

Compared 3% of the time

Microsoft Sentinel vs Devo

Compared 3% of the time

More Devo Competitors

Splunk Enterprise Security vs NetWitness Platform

Compared 7% of the time

IBM Security QRadar vs NetWitness Platform

Compared 7% of the time

Idira Privileged Access Manager vs NetWitness Platform

Compared 6% of the time

Palo Alto Networks WildFire vs NetWitness Platform

Compared 6% of the time

RSA enVision vs NetWitness Platform

Compared 5% of the time

More NetWitness Platform Competitors

Product Reports

Buyer's Guide

Devo

August 2026

Download Devo product report

Buyer's Guide

NetWitness Platform

July 2026

Download NetWitness Platform product report

Also Known As

No data available

RSA Security Analytics

Overview

Devo offers powerful visual analytics, real-time data querying, and log integration capabilities within a cloud-native, multi-tenant architecture, supporting extended data retention ideal for long-term analysis and compliance.

Devo is recognized for its Activeboards, which facilitate visual analytics. High-speed search capabilities and real-time analytics enable efficient data manipulation and querying. Its multi-tenant architecture supports effective data segregation and customization tailored to distinct business needs, enhancing its value for handling complex log integrations. With extended data retention of 400 days and a cloud-native architecture, Devo is a robust platform for long-term analysis and compliance requirements. Though opportunities exist to improve browser stability on large searches, SOAR integrations, and its parser capabilities, Devo remains essential for incident response and security monitoring, offering centralized data storage and analysis.

What are Devo's most important features?

Activeboards: Facilitate visual analytics and data exploration.
High-Speed Search: Enables fast data querying and manipulation.
Real-Time Analytics: Supports instant insights and decision-making.
Multi-Tenant Architecture: Allows effective data segregation and customization.
Extended Data Retention: Offers 400-day log retention for compliance and analysis.
Complex Log Integration: Handles intricate data sources effortlessly.

What benefits and ROI should organizations look for in reviews?

Visual Insights: Enhance understanding through interactive dashboards.
Performance Efficiency: Saves time with high-speed data search and real-time results.
Customization Flexibility: Fits specific business requirements with multi-tenant architecture.
Long-Term Compliance: Ensures alignment with extended data retention needs.
Centralized Monitoring: Enables comprehensive incident response and security monitoring.

Devo is extensively used in industries focused on incident response and digital forensics, centralizing data for security monitoring across hybrid environments. Organizations benefit from its ability to store and analyze aggregated logs, creating alerts and dashboards to enhance visibility for network and endpoint activities in multi-domain settings.

Devo

NetWitness Platform provides seamless threat intelligence integration and robust log/packet ingestion. It enhances network visibility and incident management through automated threat detection, ideal for enterprises seeking scalability and security intelligence.

NetWitness Platform offers a comprehensive suite of tools designed to tackle security challenges within Security Operations Centers. It integrates data from endpoints, networks, and other sources, ensuring in-depth security analysis. By supporting features like XDR and UEBA, it grants a unified view of security events. Its capabilities extend to threat hunting, malware analysis, and network forensics, assisting organizations in managing incidents, ensuring compliance with regulations like GDPR, and detecting cyber threats. Users appreciate its ease of deployment, flexibility, and threat prediction capabilities, although improvements in integration, documentation, and AI are desired.

What are the key features of NetWitness Platform?

User-friendly Interface: Simplifies security monitoring and management.
Threat Intelligence Integration: Provides seamless access to threat data.
Log/Packet Ingestion and Alerting: Enhances detection and response.
Network Visibility: Improves threat detection across networks.
Incident Management: Streamlines response to security incidents.
Automated Threat Detection: Facilitates quick identification of threats.
Custom Connectors: Allows for tailored integrations.
Advanced Dashboarding and Reporting: Offers detailed insights.
Packet/Incident Correlation: Enhances understanding of threats.

What benefits can users expect when evaluating NetWitness Platform?

Threat Prediction: Anticipates potential vulnerabilities.
Ease of Use: Streamlines user experience.
Deployment Flexibility: Adapts to organizational structure.
Scalability: Supports growing security infrastructure needs.
Security Intelligence: Enhances awareness and response capabilities.

In finance and health sectors, NetWitness Platform aids significantly by providing comprehensive threat analysis, ensuring compliance, and facilitating rapid incident management. Enterprises in these industries benefit by maintaining robust security postures and meeting regulatory demands.

NetWitness

Sample Customers

United States Air Force, Rubrik, SentinelOne, Critical Start, NHL, Panda Security, Telefonica, CaixaBank, OpenText, IGT, OneMain Financial, SurveyMonkey, FanDuel, H&R Block, Ulta Beauty, Manulife, Moneylion, Chime Bank, Magna International, American Express Global Business Travel

Los Angeles World Airports, Reply

Buyer's Guide

Devo vs. NetWitness Platform

August 2026

Free Report: Devo vs. NetWitness Platform

Find out what your peers are saying about Devo vs. NetWitness Platform and other solutions. Updated: August 2026.

DOWNLOAD NOW

908,877 professionals have used our research since 2012.

See our Devo vs. NetWitness Platform report.

See our list of best Log Management vendors and best Security Information and Event Management (SIEM) vendors.

We monitor all Log Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.