Try our new research platform with insights from 80,000+ expert users

NetWitness Platform vs Trellix ESM comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 18, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

NetWitness Platform
Ranking in Security Information and Event Management (SIEM)
32nd
Average Rating
7.4
Reviews Sentiment
7.4
Number of Reviews
36
Ranking in other categories
Log Management (35th)
Trellix ESM
Ranking in Security Information and Event Management (SIEM)
27th
Average Rating
7.4
Reviews Sentiment
7.0
Number of Reviews
38
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of February 2026, in the Security Information and Event Management (SIEM) category, the mindshare of NetWitness Platform is 0.9%, up from 0.6% compared to the previous year. The mindshare of Trellix ESM is 1.2%, up from 0.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM) Market Share Distribution
ProductMarket Share (%)
Trellix ESM1.2%
NetWitness Platform0.9%
Other97.9%
Security Information and Event Management (SIEM)
 

Featured Reviews

MOTASHIM Al Razi - PeerSpot reviewer
CISO at One Bank Limited
It is a stable solution, but they should make the user interface easier to understand
The solution's initial setup takes work. We have to organize multiple paths and many features. The deployment process takes less than a week. But it takes a month to complete if we want to make the solution smarter by integrating it with various devices. I rate the process as a six out of ten.
MD
Senior Vice President IT at AS IT Consulting Pvt. Ltd.
Offers comprehensive report generation while maintaining ease of integration
We need to improve Trellix ESM by making sure that most of the logging devices available in the global market should be covered, and if there is any device which is not covered, there should not be any additional charges for writing the custom parsers on that. We can add some new features regarding AI in the future for Trellix ESM, but the maturity will take a longer time. There are many false positives that happen in an environment during the first couple of months, or around six months, so the system analyst is not able to identify whether the event which has occurred is a true positive or a false positive.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"What we are mainly using are the RSA concentrator, RSA Decoder, Archiver, Broker, and Log Decoder."
"In my opinion, the solution's most valuable feature is its capacity to monitor network traffic, logs from devices within the network, and network captures. This capability extends beyond logs to include full network capturing."
"Offers a good wireless feature."
"It gives the ability to investigate into network traffic in the Net and the organization what we couldn't do before."
"Incident management is its most valuable feature."
"It's quite economical compared to other solutions in the market."
"Possibility to investigate incidents based on logs and raw packets, such as extracting files sent over the network"
"NetWitness Platform offers flexibility for deployment and robust integration capabilities."
"The most valuable feature is that if the scanning does find something, it quarantines it. Then you can decide what you are going to do with it."
"I like the ease of deployment."
"The strongest part of Trellix ESM is that we get quite good reports."
"I rate the tool's deployment an eight out of ten. The deployment is completed in two days."
"The support I have received from the vendor has been great."
"The ease of use is the most valuable feature. Over the years I have always been using this solution and have become comfortable with it."
"Compared to other solutions, the user interface is good."
"It blocks the things which are not to be allowed. It has an adaptive mode where it learns for itself."
 

Cons

"The documentation is not as structured as I would like, personally, and I think that it can be improved and made much more user-friendly."
"The threat detection capability and centralizing and upgrading capability need to be improved. The threat alert capability needs to be improved as well because there is some lag time at present. They need to work on their database search too."
"The solution should have more integration capabilities with different platforms."
"The tool's integration capability isn't so great."
"The system architecture is complex and sometimes it’s hard to troubleshoot potential problems."
"I'd like to see improvement in its ease of use. It's basically unusable. It's overly complex."
"Lots of competing products have vulnerability protection built into their products, and this solution would be improved by including that support."
"The initial setup is complex. There are other solutions that are easier to implement."
"Product-wise, adding accounts on a single data source by batch would be a really great help."
"The product's stability is an area of concern where improvements are required."
"We acquired the IBM product because McAfee is slightly confusing to use, and it's broader."
"The user interface could be more user-friendly."
"It is more difficult to operate Trellix ESM than other solutions."
"Areas of Trellix ESM that could be improved or enhanced include checking on the clients who are still on-prem, especially banks, as most are not moving everything to the cloud due to confidentiality and accessibility during network outages."
"We cannot add new data sources to the most recent version."
"It cannot integrate with our Next-Generation Firewall and few applications such as Cisco ACI."
 

Pricing and Cost Advice

"Many clients are not able to purchase the packet capability because there is a huge amount of data, and the cost depends on the number of EPS (Events per second), as well as the number of gigabytes of data per day."
"We are on an annual license for the use of the solution."
"RSA NetWitness Logs and Packets do not have a subscription model, it's a one-time purchase. There is only a perpetual license."
"It provides tools to assist in selecting the appropriate license and usage scenarios."
"We have a perpetual license, so the total cost of ownership is not very expensive. It's a good investment."
"The licenses are good but the cost is very expensive."
"The new pricing and licensing mechanisms are fair. I would advise always to get the full solution (i.e., not only Logs)."
"Our license is for one year."
"You should buy the distributed option instead of the all-in-one for environments with more than 1000 end points."
"The cost is all included. The finance department handles the financial part, and we mostly don't get involved in it."
"When compared to IBM Security QRadar and other similar platforms, the pricing of McAfee ESM is reasonable and comparatively less expensive."
"The pricing is fair."
"Regarding pricing, Trellix ESM is not that expensive. It's less than half the cost of IBM QRadar."
"We renew our license annually."
"The cost is dependent on the customer's environment and requirements."
"The price of McAfee ESM is higher than some of the other solutions. There are additional features that can be added at an additional fee."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
881,733 professionals have used our research since 2012.
 

Comparison Review

VS
Manager, Enterprise Risk Consulting at a tech company with 1,001-5,000 employees
Feb 26, 2015
HP ArcSight vs. IBM QRadar vs. ​McAfee Nitro vs. Splunk vs. RSA Security vs. LogRhythm
We at Infosecnirvana.com have done several posts on SIEM. After the Dummies Guide on SIEM, we are following it up with a SIEM Product Comparison – 101 deck. So, here it is for your viewing pleasure. Let me know what you think by posting your comments below. The key products compared here are…
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Performing Arts
8%
Computer Software Company
8%
Manufacturing Company
7%
Comms Service Provider
16%
Financial Services Firm
9%
Manufacturing Company
8%
Construction Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise7
Large Enterprise20
By reviewers
Company SizeCount
Small Business15
Midsize Enterprise6
Large Enterprise24
 

Questions from the Community

What do you like most about NetWitness Platform?
The product's initial setup phase was not at all difficult.
What is your experience regarding pricing and costs for NetWitness Platform?
The pricing is comparable to others, and I consider the cost to be intermediate. Specific cost details are unknown to me.
What needs improvement with NetWitness Platform?
There is currently no need for improvement in the SIEM ( /categories/security-information-and-event-management-siem ), though there could be potential enhancements by integrating with AI.
What is your experience regarding pricing and costs for McAfee ESM?
When discussing Trellix ESM pricing and licensing, if you consider some premium product, the pricing also has to be premium, however, enterprise customers who look for a premium product, alongside ...
What needs improvement with McAfee ESM?
Areas of Trellix ESM that could be improved or enhanced include checking on the clients who are still on-prem, especially banks, as most are not moving everything to the cloud due to confidentialit...
What is your primary use case for McAfee ESM?
My customer's usual use case for Trellix ESM involves one client, as most of the users have moved to ESM. Nowadays, they don't use IPS only, since McAfee IPS is standalone; they incorporate firewal...
 

Also Known As

RSA Security Analytics
McAfee ESM, NitroSecurity, McAfee Enterprise Security Manager
 

Overview

 

Sample Customers

Los Angeles World Airports, Reply
San Francisco Police Credit Union, Wªstenrot Gruppe, Volusion, California Department of Corrections & Rehabilitation, Government of New Brunswick, State of Colorado, Macquarie Telecom, Texas Tech University Health Sciences Center, Cologne Bonn Airport
Find out what your peers are saying about NetWitness Platform vs. Trellix ESM and other solutions. Updated: February 2026.
881,733 professionals have used our research since 2012.