No more typing reviews! Try our Samantha, our new voice AI agent.

NETSCOUT Arbor DDoS Protection & Mitigation vs NetWitness Platform comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NETSCOUT Arbor DDoS Protect...
Average Rating
8.8
Reviews Sentiment
6.9
Number of Reviews
57
Ranking in other categories
Distributed Denial-of-Service (DDoS) Protection (4th)
NetWitness Platform
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Log Management (36th), Security Information and Event Management (SIEM) (35th)
 

Mindshare comparison

NETSCOUT Arbor DDoS Protection & Mitigation and NetWitness Platform aren’t in the same category and serve different purposes. NETSCOUT Arbor DDoS Protection & Mitigation is designed for Distributed Denial-of-Service (DDoS) Protection and holds a mindshare of 5.5%, down 11.4% compared to last year.
NetWitness Platform, on the other hand, focuses on Log Management, holds 1.2% mindshare, up 0.4% since last year.
Distributed Denial-of-Service (DDoS) Protection Mindshare Distribution
ProductMindshare (%)
Arbor DDoS5.5%
Cloudflare11.7%
Imperva Application Security Platform7.6%
Other75.2%
Distributed Denial-of-Service (DDoS) Protection
Log Management Mindshare Distribution
ProductMindshare (%)
NetWitness Platform1.2%
Splunk Enterprise Security7.1%
IBM Security QRadar4.5%
Other87.2%
Log Management
 

Featured Reviews

reviewer1331304 - PeerSpot reviewer
Director Of Research And Development at a comms service provider with 11-50 employees
Automated threat intelligence and flow-based mitigation have improved our DDoS defense
A very useful feature in Arbor DDoS is its ability to send flow spec announcements to routers. For example, if it is clear that a Layer 3 or Layer 4 attack is occurring and the attack pattern is identified through source and destination IP addresses and ports, you can generate flow spec filters. These filters are transferred through BGP to border routers, which automatically build filters, mitigating the attack even at the network's boundary and preventing it from reaching the TMS. This allows the TMS to focus on other tasks. This is a highly effective feature that can mitigate huge volumetric attacks; for example, we experienced a 32-gigabit attack, and all those 32 gigabits were dropped by our border routers, not by Arbor DDoS itself. The flow spec announcement was generated by Arbor DDoS, and as far as I know, the same technology is used by Radware, but it comes under a different feature and a different license. At the time, we were told that flow spec mitigation was an additional very expensive license to purchase from Radware, while Radware included everything in one package.
reviewer1130436 - PeerSpot reviewer
Information Technology Security and Infrastructure Expert at a government with 201-500 employees
Helps to deal with potential attacks and is available at a reasonable price
My company has had many benefits from the use of the product in the last eight years. The tool has streamlined our company's incident response process since it serves as a log repository, which allows us to correlate events and access different technology stacks. In our company, we were able to actually find some potential attacks, so it has been very helpful. The tool's integration capability isn't so great. In my company, we managed to integrate it with our Microsoft Azure Subscription, after which we managed to integrate it with other tools. You will face a lot of difficulties if you want to integrate it with your database monitoring tool, PAM solutions, or IAM products. The product has done well overall for my company's teams to deal with their workflow efficiency. I would not recommend the product to others. I rate the tool a seven out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It is user-friendly and has a very easy GUI."
"I recommend using Arbor DDoS for those wanting to keep their services online."
"The solution is really stable and is the most stable device in our topology."
"When there was an attack, the attack was contained only on the IPs under attack, the rest of the network was not impacted, and that is the most important part."
"The ability to correlate Arbor managed objects with internet services deployed accurately profiles traffic and makes coordinating appropriate mitigation response simple."
"Arbor DDoS has given us a very good ROI."
"They have done a considerable amount of development in the last few years when it comes to features."
"We found what we wanted in Arbor DDoS; it met our expectations as IT users of different types of complex environments and fit our needs."
"It's quite economical compared to other solutions in the market."
"The most valuable feature is that we can create our own connectors for any application, and NetWitness provides the training and tools to do it."
"The most valuable features are its ingestion of logs and raising of alerts based on those logs."
"RSA NetWitness is a SIEM and real-time network traffic solution that collects logs and packets, applies a set of alerting, reporting, and analysis rules on them, and thus provides the enterprise with full visibility of the networks and activities of the systems."
"NetWitness Platform is valuable for creating rules that the solution must detect."
"It gives customers visibility about their most important servers and devices."
"The most valuable feature is the ability to write rules and triggers for network communication and then being able to investigate based on that, where you can see the payload and deconstruct the packets."
"The most valuable feature of RSA NetWitness Logs and Packets are the alerts and correlations tools."
 

Cons

"Arbor's SSL decryption is confusing and needs external cards to be installed in the devices. This is not the best solution from an architectural point of view for protecting HTTPS and every other protocol that is SSL encrypted."
"There are some price issues with scalability, but technically speaking, the solution is fully scalable."
"I believe that the Arbor Cloud should be available, even if the customer does not have any Arbor appliance on-premise."
"An improvement to Arbor DDoS would be to make evaluation licenses and virtual machines available."
"An improvement would be to provide information on how pricing is done on different customer levels (e.g. is it done per gig or bandwidth?)."
"Arbor DDoS has some difficult pricing rules. For many different small features, we have to pay additional fees for every small feature."
"There is definitely room for improvement in third-party intelligence and integrations."
"Because we had some routers that were somewhat old, they were not integrated with Arbor. They did not support the NetFlow version that Arbor was running. That was a challenge. We had to upgrade the routers. Some backward-compatibility would be helpful."
"RSA NetWitness Logs and Packets is far behind the competition."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"Security needs improvement. We would still like to know how the traffic is entering the organization."
"We encountered stability issues in the earlier versions, and much fewer in the newer versions."
"The multi-tenant capabilities are lagging compared to IBM QRadar."
"The system looks like it is a mix of a bunch of different systems, and nothing looked like it was quite together."
"Technical support could be improved."
"More customizability is required, which is something that they need to improve on."
 

Pricing and Cost Advice

"Because the solutions from competitors are very different, it's not easy to compare. However, the licensing from Arbor is clear and understandable and the pricing is reasonable when looking at the market, in general."
"It is an expensive product. I use this product for its different features."
"I'm a technical guy. But I know it's expensive compared to its competitors. After you have the on-premise solution, for your solution to be effective you have to subscribe to an "upper level," so there's another cost. There is also a subscription to cloud services, which is another cost."
"Arbor is striking a good balance between pricing and what they deliver."
"The licensing of a complete Arbor solution, including fire-walling and unified site management, can get expensive."
"Arbor DDoS is quite expensive, but all these solutions are expensive because they deal with confidential information."
"I don't know about the pricing details as our company's service provider offers us the solution as an inbuilt feature within the internet bandwidth they provide us."
"Pricing is slightly on the higher side."
"The product is expensive."
"Our license is for one year."
"The NetWitness Platform may be affordable only for enterprise-level customers, as it may not be within the budget of small and medium-sized businesses."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"There is a licensing fee and the customer can choose whether he wishes this to be subscription-based or perpetual."
"In comparison to other SIEM solutions such as Splunk, NetWitness is less costly."
"We have yearly licensing costs. The license fee can be based on the volume of EPS. Some organizations may have, as a gentlemanly gesture, 10,000 EPS and get a 3,000 EPS license but actually use 5,000 EPS."
report
Use our free recommendation engine to learn which Distributed Denial-of-Service (DDoS) Protection solutions are best for your needs.
916,771 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
16%
Outsourcing Company
11%
Comms Service Provider
8%
Construction Company
7%
Construction Company
12%
Financial Services Firm
12%
Comms Service Provider
10%
Outsourcing Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business26
Midsize Enterprise14
Large Enterprise29
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
 

Questions from the Community

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
I would say if it’s an ISP that will build a scrubbing center, Netscout/Arbor is a good solution. In all other solutions, Imperva is a great choice.
Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Arbor would be the best bid, apart from Arbor, Palo Alto and Fortinet have good solutions. As this is an ISP, I would prefer Arbor.
What is your experience regarding pricing and costs for Arbor DDoS?
The prices for Arbor DDoS are expensive. The licensing is subscription-based. From our sales department, they discuss that prices are very high.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your primary use case for NetWitness Platform?
I use NetWitness Platform ( /products/netwitness-platform-reviews ) in the financial industry as a good product with excellent capabilities and integration with various devices.
 

Also Known As

Arbor Networks SP, Arbor Networks TMS, Arbor Cloud for ENT
RSA Security Analytics
 

Overview

 

Sample Customers

Xtel Communications
Los Angeles World Airports, Reply
Find out what your peers are saying about Radware, Cloudflare, Imperva and others in Distributed Denial-of-Service (DDoS) Protection. Updated: October 2026.
916,771 professionals have used our research since 2012.