


NetWitness NDR and Elastic Security compete in the NDR and SIEM markets. Elastic Security appears to have an edge due to its feature-rich offerings, whereas NetWitness NDR is noted for its customer support and ease of deployment.
Features: NetWitness NDR users value advanced threat detection, efficient traffic analysis, and real-time monitoring. Elastic Security is appreciated for its scalability, comprehensive search capabilities, and seamless integration with other products. Elastic Security has a broader feature set and better integration capabilities.
Room for Improvement: NetWitness NDR needs better documentation, enhanced analytics, and improved reporting. Elastic Security requires better alert management, reduced false positives, and enhanced user interface. Elastic Security's focus on alert management is particularly critical.
Ease of Deployment and Customer Service: NetWitness NDR is favored for straightforward deployment and responsive customer service. Elastic Security users find deployment manageable but sophisticated. NetWitness NDR stands out for its ease of deployment and superior customer support.
Pricing and ROI: NetWitness NDR has higher setup costs justified by its performance and support. Elastic Security offers a better cost-benefit ratio with extensive features, making it a compelling choice for pricing and ROI.
Since we started working with Torq, I am handling much fewer alerts. It is becoming really easy for me to handle an alert.
By the time we officially bought Torq, we already had two workflows that were very helpful to us.
It pretty much took until we got to our first renewal where we said that this is the value we see, this is the things we want more, but that is the first place where we said we are happy enough that we want to renew.
It does not require hefty security budgets and can be deployed for enterprise security effectively.
The speed and quality of their answers have been pretty good, as I usually get a response within 24 hours, and they follow up well.
We can always get an answer, and the support team are experts in their own system.
Nine out of ten times, they give me a solution even if it is not the solution I wanted, and I still can get to the result.
Support is prompt and helpful.
Most of the time when my team encounters issues, they receive responses within 24 hours.
I have not faced any difficulties with Elastic Security, as we have a pretty good support service from them.
Our case management is super scalable.
In terms of scalability, you can do as long as you can build it, and they can support it.
Regarding the ability of the solution to grow in your work environment, if it is scalable, if it fits your business requirements, and if there is room to scale up, the answer is yes, for sure.
It allows us to think about specific use cases, such as gathering malicious IPs in a single view and analyzing threats based on geolocation.
Elastic Security is quite scalable.
Most of the time, the system is stable as long as the components that they integrate with are stable.
Regarding stability, I have noticed some lagging, crashing, and downtime, which is one of my largest gripes.
I would rate Torq's product stability at eight, acknowledging that there are bugs, glitches, and downtimes.
In terms of stability, I would rate Elastic a solid eight out of ten.
It was able to capture data but was unable to differentiate between the agent hostname we are using and the hostname that resides on the back end of the Internet.
From an engineering perspective, I think more error messages and error handling information for our engineering team would be very helpful.
If a step is failing, the system could try to autocorrect it with AI or open a ticket from the workflow itself.
CrowdStrike and Defender have more established threat intelligence integration due to having a larger client base.
My security testing team continuously reports vulnerabilities, and we have to fix and update the versions frequently.
Machine learning algorithms become better with time; as they ingest a huge volume of data, they become better.
When they bring more and more value into the platform, it makes more sense to pay that price, but still, it is expensive.
Before deciding to implement Torq, I considered that compared to our old case management platform, Torq was a much better price and had a lot better value for what you get out of the platform, which was a key consideration for the company.
It is an expensive solution, not an inexpensive solution, but we get through the flexibility.
The pricing is reasonable, especially for Small Medium Enterprises (SMEs), making it a viable option for businesses building their security infrastructure.
This is beneficial for SMEs as they do not need extensive budgets for security solutions.
Elastic Security is considered cost-effective, especially at lower EPS levels.
Torq's unified platform approach to AI SOC automation and case management has significantly benefited us by integrating the case management platform with the automation, which saves time compared to managing multiple point solutions across our security stack.
The fact that I can build whatever I want within my own imagination and skills without relying on code is the best thing about Torq.
You can copy and paste a cURL command. If you have documentation or APIs, you usually have an example on the side. You basically have all the information on how the API call should be. You can just copy that and paste it into a step, and it will just build the step for you.
Elastic Security offers good insight regarding alerts, reports, and cases.
Elastic Security offers advanced features such as machine learning and integration with ChatGPT.
We require rapid processing speed for alerts and event data, and Elastic Security is very efficient at handling this level of data.


| Company Size | Count |
|---|---|
| Midsize Enterprise | 3 |
| Large Enterprise | 4 |
| Company Size | Count |
|---|---|
| Small Business | 40 |
| Midsize Enterprise | 11 |
| Large Enterprise | 15 |
| Company Size | Count |
|---|---|
| Small Business | 10 |
| Midsize Enterprise | 2 |
| Large Enterprise | 5 |
Torq is the enterprise AI SOC solution that effectively combines adaptive insights and automation to handle critical threats efficiently. It manages threat lifecycles, swiftly moving from triage to response, ensuring effective risk management.
Torq is designed to streamline security operations by aggregating telemetry across your security stack. It investigates significant risks and manages threats from triage to containment and remediation. This AI-driven tool enhances the capabilities of your SecOps team, allowing them to achieve more impactful results without introducing complicated processes.
What are the key features of Torq?In industries like finance and healthcare, Torq shows effectiveness by adapting to specific risk scenarios often encountered in these fields. Its integration with existing infrastructures makes it a valuable asset for maintaining stringent security standards, essential for protecting critical data and operations in diverse high-stakes environments.
Elastic Security combines the features of a security information and event management (SIEM) system with endpoint protection, allowing organizations to detect, investigate, and respond to threats in real time. This unified approach helps reduce complexity and improve the efficiency of security operations.
Additional offerings and benefits:
Finally, Elastic Security benefits from a global community of users who contribute to its threat intelligence, helping to enhance its detection capabilities. This collaborative approach ensures that the solution remains on the cutting edge of cybersecurity, with up-to-date information on the latest threats and vulnerabilities.
Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.
We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.