No more typing reviews! Try our Samantha, our new voice AI agent.

IBM SevOne Network Performance Management (NPM) vs NetWitness Platform comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 3, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

IBM SevOne Network Performa...
Ranking in Log Management
35th
Average Rating
8.4
Reviews Sentiment
7.2
Number of Reviews
54
Ranking in other categories
Network Monitoring Software (30th), Server Monitoring (16th), IT Infrastructure Monitoring (35th), Cloud Monitoring Software (27th)
NetWitness Platform
Ranking in Log Management
36th
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Security Information and Event Management (SIEM) (34th)
 

Mindshare comparison

As of September 2026, in the Log Management category, the mindshare of IBM SevOne Network Performance Management (NPM) is 1.1%, up from 0.4% compared to the previous year. The mindshare of NetWitness Platform is 1.1%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Log Management Mindshare Distribution
ProductMindshare (%)
IBM SevOne Network Performance Management (NPM)1.1%
NetWitness Platform1.1%
Other97.8%
Log Management
 

Featured Reviews

reviewer1543041 - PeerSpot reviewer
Network monitoring engineer at a tech vendor with 10,001+ employees
Provides consistent infrastructure monitoring with excellent usability and support
The primary use case of IBM SevOne Network Performance Management (NPM) is network monitoring. It helps to maintain the infrastructure's availability and ensure that alerts are generated when needed The most valuable features of IBM SevOne Network Performance Management (NPM) are its stability,…
reviewer2256927 - PeerSpot reviewer
Head of Information Security, Cyber Defense and IT Risk Management at HCT. at a transportation company with 201-500 employees
A solid SIEM solution that should improve technical support and online resources to be easier to use
A big problem with the product is that we don't have much professional experience in Israel installing, implementing, and integrating this product. There is not enough of a knowledge base. There is no support for this product in this country, so problems have to be resolved through global technical teams. We like to work locally because of the language, and when the product is only supported outside the country, it's a little difficult to implement and use this product. Moreover, AI is something that must be added immediately. Artificial intelligence is a part of the competitors' products, and it's not been implemented for us.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It's good to go with SevOne because the creation of thresholds, of policies, the grouping of servers, that is easy."
"The most valuable features for us are the huge number of network devices it can monitor."
"I don't think the product cost compares to the savings we get by detecting a problem and resolving a problem faster."
"Definitely go for it."
"It is one of the most important systems we have in our environment for monitoring devices."
"We have increased our capability a hundred-fold over, so it was more of a customer performance thing than ROI."
"SevOne provides support for all universal connectors. They internally work with other data sources to get features implemented. We have an SD-WAN implementation and use other app data to monitor performance. If you pull that data into one centralized location, that is very useful for management."
"The comprehensiveness of this solution's collection of network performance and flow data is one of the basics in the field for what it does. It meets all of our needs. So for all those areas, for the most straightforward collection capabilities, right up to NetFlow and even telemetry, it meets all those demands. Not only just basic or fundamental SNMP collection capability, but the product also supports what we need for the future with telemetry streaming. So it's very comprehensive."
"I can have enterprise security, email security, next generation firewall security log, HIDS and NIDS logs, etc. all on the same dashboard. It makes it easy to pinpoint or correlate our server to this. I can find out if there is lateral movement. This is the biggest advantage of this solution."
"The product has a user-friendly interface and a valuable feature for threat intelligence integration."
"The most valuable feature is the ability to write rules and triggers for network communication and then being able to investigate based on that, where you can see the payload and deconstruct the packets."
"Alerting Module: It provides real-time event processing language on all the logs/packets stream for advanced alerting, i.e., using SQL LIKE statements."
"The solution is reliable."
"It gives customers visibility about their most important servers and devices."
"The software is scalable to whatever is required, and you can also put a lot of resources in the cloud."
"Setting up NetWitness is straightforward. There are multiple connectors, including standard and specialized connectors. One purpose of the connectors is the enhanced capability integrate the custom applications. NetWitness comes with E6 appliances and application images that we use for the initial configurations and for the OS stack information. From there, you can consider the correlation rules, integrate the different log sources, and easily create correlation rules and backlog reports."
 

Cons

"Telemetry is hot these days, and IBM can improve SevOne's support for telemetry correction. Reporting is another feature that could be better. It provides the bare minimum functionality, which is good enough for most engineers, but the management isn't advanced. The new portal provides a much lighter view and better visualization, but the management is not so good."
"NMS has several areas for improvement. It should be more user-friendly inside of NMS for some of the functionality in there. It's been getting better the last version or two, but the there have been bugs in there whenever I've gone to new versions."
"We initially had issues getting the product to accommodate the number of network devices to monitor."
"I would like to see live maps as an added feature. Also, build modules on AI and EML to provide better data insights that would proactively tell us what we should be looking after."
"SevOne should work with the graphs legend functionality."
"This product needs a lot of handholding and close collaboration with network design resources, in terms of choosing the appliance and the number of licenses."
"The method of searching for SIP and the way to create the groups."
"SevOne could improve its flexibility because it isn't fully customizable and its out-of-the-box configuration doesn't cover all use cases."
"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."
"I believe that integrating the solution with other products such as Oracle would be beneficial."
"It is not so easy to customize this product."
"It is overly complicated. It has taken years to implement and the return on investment just isn't there."
"RSA NetWitness Logs and Packets is far behind the competition."
"RSA NetWitness Logs and Packets can improve the threat level aspect, it is lacking compared to other solutions."
"It should have a monitoring feature. It would help us analyze the current state of attacks faster from a single platform."
"We encountered stability issues in the earlier versions, and much fewer in the newer versions."
 

Pricing and Cost Advice

"There are cheaper solutions available."
"It is inexpensive compared to other monitoring tools."
"Many tools price things based on the number of KPIs that you're collecting around a device. In many cases, there could be hundreds of metrics that you need to collect. SevOne provides device-level pricing. That gives us the flexibility to turn on, and expand on, the metrics that we're collecting around those devices, without taking a financial hit."
"Although I don't have exact details in terms of cost, my experience has been that SevOne is willing to make a deal with the customer."
"Choose a SevOne partner who can provide SevOne as a service and can deliver professional services and maintenance."
"There are different options available for licensing, with the per-device option being more expensive but more flexible."
"A blocking point is the high upfront cost because it is challenging to get it accepted and the purchase approved."
"The tool is not expensive. We were able to negotiate with SevOne on pricing."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"The licenses are good but the cost is very expensive."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
"The tool is very expensive, so I rate the pricing a ten out of ten. The solution has an annual subscription."
"Compared to the competition, the is price is not that high."
"Our license is for one year."
report
Use our free recommendation engine to learn which Log Management solutions are best for your needs.
914,109 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Construction Company
12%
Financial Services Firm
12%
Manufacturing Company
10%
Outsourcing Company
9%
Construction Company
13%
Financial Services Firm
11%
Comms Service Provider
11%
Outsourcing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise6
Large Enterprise45
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

What needs improvement with SevOne Network Data Platform?
There is room for improvement in the integration with different vendors and the reporting capabilities. It would be beneficial to have out-of-the-box integration with third-party vendors and improv...
What is your primary use case for SevOne Network Data Platform?
The primary use case of IBM SevOne Network Performance Management (NPM) ( /products/ibm-sevone-network-performance-management-npm-reviews ) is network monitoring. It helps to maintain the infrastru...
What advice do you have for others considering SevOne Network Data Platform?
To compete with custom-built tools, IBM SevOne Network Performance Management (NPM) should accommodate the desired features and be timely in the delivery of feature updates. I would rate the overal...
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

SevOne
RSA Security Analytics
 

Overview

 

Sample Customers

ATOS, Devereux, Spark New Zealand, Access4, Rogers Communication, Lumen (formerly known as CenturyLink)
Los Angeles World Airports, Reply
Find out what your peers are saying about IBM SevOne Network Performance Management (NPM) vs. NetWitness Platform and other solutions. Updated: September 2026.
914,109 professionals have used our research since 2012.