- Home
- Security Information and Event Management
- NetWitness Platform
NetWitness Platform
LinkedIn lists Boston, Massachusetts as headquarters.
What it is
NetWitness Platform is a threat detection, investigation and response system for complex IT and OT environments. Its modules include network and endpoint detection, SIEM, SOAR and UEBA, alongside described OT security. Network monitoring uses full packet capture and metadata analysis to reconstruct sessions. Machine learning and behavioral analytics are described for identifying known and unknown threats, anomalous behavior and real-time alerts. SIEM ingests logs from more than 350 sources, including AWS, Azure, Office 365 and Salesforce, through Syslog, ODBC, SFTP, FTPS and SNMP. It provides reporting templates and use cases for SOX, PCI, HIPAA and NERC. SIEM can be deployed on-premises, virtually or in cloud environments such as AWS and Azure. The EDR agent is described for hundreds to 100,000 endpoints with near-zero end-user impact. NetWitness runs on Linux, self-hosted and web environments; pricing is on request.
For and against
For
- Combines NDR, EDR, SIEM, SOAR and UEBA
- Full packet capture and session reconstruction
- Ingests logs from over 350 sources
- Supports on-premises and cloud deployment
- Offers documented support and training
Against
- Pricing is available only on request
- Designed for large complex environments
- Deployment options require implementation planning
- Platform spans multiple security modules
The verdict
NetWitness brings network, endpoint, log and response capabilities into one security platform. Its broad module set and deployment choices target organizations with extensive infrastructure and security operations.
Who it suits
NetWitness is designed for large, complex enterprises and serves enterprise and government customers managing IT and OT security.
Plans and prices
NetWitness Platform
custom pricing · deployment scale and data volumes determine configuration · support options available on request
Read 15 Oct 2026 · external.pi.gpi.aws.gartner.com
On the record
- 12.5 release
- The October 7, 2024 release announcement described broader visibility, a redesigned role-based interface and more automation and intelligence-driven detection.netwitness.com · read 15 Oct 2026
- API
- The public API follows HTTP and REST conventions, exchanges JSON, and supports version selection through the NetWitness-Version header.community.netwitness.com · read 15 Oct 2026
- Company size
- LinkedIn lists NetWitness as privately held with 1,001–5,000 employees.linkedin.com · read 15 Oct 2026
- Deployment
- The SIEM page lists on-premises, virtual, and cloud deployment, including AWS and Azure.netwitness.com · read 8 Oct 2026
- Deployment models
- Deployment documentation covers physical hosts, on-premises virtual hosts and AWS, Azure and GCP cloud environments.community.netwitness.com · read 15 Oct 2026
- Documentation
- The vendor documentation hub provides deployment, configuration, optimization, investigation and orchestration guides.netwitness.com · read 15 Oct 2026
- Endpoint detection
- The EDR module monitors endpoint activity on and off the corporate network for incident investigation and response.netwitness.com · read 15 Oct 2026
- Endpoint scale
- The EDR page says its agent can be deployed across hundreds to 100,000 endpoints with near-zero end-user impact.netwitness.com · read 8 Oct 2026
- Independent assessment
- eSecurity Planet says implementation complexity and the number of components may limit NetWitness to larger organizations with experienced security teams.esecurityplanet.com · read 15 Oct 2026
- Independent deployment
- eSecurity Planet says NetWitness can run as software, physical appliances, virtual appliances or hybrid configurations.esecurityplanet.com · read 15 Oct 2026
- Independent pricing
- eSecurity Planet reported throughput-based pricing, with a historical typical-enterprise starting price of $857 per month for a term license.esecurityplanet.com · read 15 Oct 2026
- Integrations
- The product advertises plug-and-play connections with SIEM, NDR, SOAR, cloud and endpoint platforms plus third-party security tools.netwitness.com · read 15 Oct 2026
- License terms
- The EULA grants a nonexclusive, nontransferable internal-use software license for the duration stated in the customer quote.netwitness.com · read 15 Oct 2026
- Licensing model
- The platform uses throughput, appliance, UEBA and endpoint license types; throughput licenses are based on daily log, packet or malware data volumes.community.netwitness.com · read 15 Oct 2026
- Limit: API
- One G2 reviewer specifically requested stronger API integration for security-operations use.g2.com · read 15 Oct 2026
- Limit: deployment complexity
- G2 reviewers repeatedly describe initial deployment as complex and requiring substantial technical expertise.g2.com · read 15 Oct 2026
- Limit: ease of use
- A Gartner critical review says tasks that should be easy can be difficult to execute.external.pi.gpi.aws.gartner.com · read 15 Oct 2026
- Limit: integrations and usability
- G2 reviews mention integration challenges, limited log-source integration, weak parsing, difficult use-case creation and an unfriendly interface.g2.com · read 15 Oct 2026
