Skip to content
SPECIFICTION
Get listed

NetWitness Platform

netwitness.com

WebWindowsmacOSLinuxAPISelf-hosted
Visit netwitness.com
Spec score 8.1 #3 of 21 in User and Entity Behavior Analytics Software

What it is

NetWitness Platform is a threat detection, investigation, and response platform for complex IT and OT environments. Its modules include network detection and response, endpoint detection and response, SIEM, SOAR, and UEBA, with additional OT security coverage described. NDR uses full packet capture and metadata analysis to monitor infrastructure and reconstruct sessions. Machine learning and behavioral analytics are described for identifying known and unknown threats and anomalous behavior, with real-time alerting. SIEM ingests logs from over 350 sources, including AWS, Azure, Office 365, and Salesforce, through Syslog, ODBC, SFTP, FTPS, and SNMP. It provides reporting templates and use cases for SOX, PCI, HIPAA, and NERC. SIEM can run on-premises, virtually, or in the cloud, including AWS and Azure. The EDR agent is described for hundreds to 100,000 endpoints with near-zero end-user impact. NetWitness is paid, supports Linux, self-hosted, and web deployments, and lists pricing on request.

Spec sheet

What it does
NetWitness is a threat detection, investigation and response platform combining network, log and endpoint telemetry across on-premises and cloud environments.Read 15 Oct 2026 · external.pi.gpi.aws.gartner.com
Purpose
NetWitness is a threat detection, investigation, and response platform for complex IT and OT environments.Read 8 Oct 2026 · netwitness.com
Deployment
The SIEM page lists on-premises, virtual, and cloud deployment, including AWS and Azure.Read 8 Oct 2026 · netwitness.com
API
The public API follows HTTP and REST conventions, exchanges JSON, and supports version selection through the NetWitness-Version header.Read 15 Oct 2026 · community.netwitness.com
Integrations
The product advertises plug-and-play connections with SIEM, NDR, SOAR, cloud and endpoint platforms plus third-party security tools.Read 15 Oct 2026 · netwitness.com
Support
NetWitness says it offers multiple levels of technical support and a customer community with Q&A, documentation, downloads, product updates, and training.Read 8 Oct 2026 · netwitness.com
Headquarters
LinkedIn lists Boston, Massachusetts as headquarters.Read 15 Oct 2026 · linkedin.com
Founded
LinkedIn lists NetWitness as founded in 1997.Read 15 Oct 2026 · linkedin.com
12.5 release
The October 7, 2024 release announcement described broader visibility, a redesigned role-based interface and more automation and intelligence-driven detection.Read 15 Oct 2026 · netwitness.com
Company size
LinkedIn lists NetWitness as privately held with 1,001–5,000 employees.Read 15 Oct 2026 · linkedin.com
Deployment models
Deployment documentation covers physical hosts, on-premises virtual hosts and AWS, Azure and GCP cloud environments.Read 15 Oct 2026 · community.netwitness.com
Documentation
The vendor documentation hub provides deployment, configuration, optimization, investigation and orchestration guides.Read 15 Oct 2026 · netwitness.com
Endpoint detection
The EDR module monitors endpoint activity on and off the corporate network for incident investigation and response.Read 15 Oct 2026 · netwitness.com
Endpoint scale
The EDR page says its agent can be deployed across hundreds to 100,000 endpoints with near-zero end-user impact.Read 8 Oct 2026 · netwitness.com
Independent assessment
eSecurity Planet says implementation complexity and the number of components may limit NetWitness to larger organizations with experienced security teams.Read 15 Oct 2026 · esecurityplanet.com
Independent deployment
eSecurity Planet says NetWitness can run as software, physical appliances, virtual appliances or hybrid configurations.Read 15 Oct 2026 · esecurityplanet.com
Independent pricing
eSecurity Planet reported throughput-based pricing, with a historical typical-enterprise starting price of $857 per month for a term license.Read 15 Oct 2026 · esecurityplanet.com
License terms
The EULA grants a nonexclusive, nontransferable internal-use software license for the duration stated in the customer quote.Read 15 Oct 2026 · netwitness.com
Licensing model
The platform uses throughput, appliance, UEBA and endpoint license types; throughput licenses are based on daily log, packet or malware data volumes.Read 15 Oct 2026 · community.netwitness.com
Limit: API
One G2 reviewer specifically requested stronger API integration for security-operations use.Read 15 Oct 2026 · g2.com
Limit: deployment complexity
G2 reviewers repeatedly describe initial deployment as complex and requiring substantial technical expertise.Read 15 Oct 2026 · g2.com
Limit: ease of use
A Gartner critical review says tasks that should be easy can be difficult to execute.Read 15 Oct 2026 · external.pi.gpi.aws.gartner.com
Limit: integrations and usability
G2 reviews mention integration challenges, limited log-source integration, weak parsing, difficult use-case creation and an unfriendly interface.Read 15 Oct 2026 · g2.com
Limit: price and licensing
The Software Advice reviewer says the price is high and the licensing model is somewhat complex.Read 15 Oct 2026 · softwareadvice.com
Modules
Its platform modules include NDR, EDR, SIEM, SOAR, and UEBA, and the company also describes OT security.Read 8 Oct 2026 · netwitness.com
Network detection
Its NDR module captures full network packets, monitors attacker movement and reconstructs complete network sessions.Read 15 Oct 2026 · netwitness.com
Network visibility
NetWitness NDR uses full packet capture and metadata analysis to monitor network infrastructure and reconstruct sessions.Read 8 Oct 2026 · netwitness.com
Praise: capabilities
The Software Advice reviewer praises UEBA, orchestration, real-time threat detection, scale-out capability and PCI DSS support.Read 15 Oct 2026 · softwareadvice.com
Praise: investigations
Gartner reviewers highlight detailed logs, network visibility, strong investigation tools and the ability to uncover complex threats.Read 15 Oct 2026 · external.pi.gpi.aws.gartner.com
Praise: threat hunting
G2 reviewers praise full-packet capture, session replay, threat correlation, investigation speed and the combination of NDR, EDR and logs in one interface.Read 15 Oct 2026 · g2.com
Rating on G2
3.9 out of 5 from 24 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.5 out of 5 from 159 ratingsRead 15 Oct 2026 · external.pi.gpi.aws.gartner.com
Rating on Software Advice
5.0 out of 5 from 1 reviewRead 15 Oct 2026 · softwareadvice.com
Risk context
Analytics enrich incidents with asset classification, exposure rank and peer-group context.Read 15 Oct 2026 · netwitness.com
Scale
NetWitness says its analytics platform processes millions of events daily in on-premises or cloud deployments.Read 15 Oct 2026 · netwitness.com
Security and trust
The NetWitness Trust Center lists ISO 9001:2015, ISO/IEC 27001:2022, and SOC 2 Type 1, and offers access to a SOC 2 Type I report.Read 8 Oct 2026 · security.netwitness.com
Security certifications
The Trust Center lists ISO 9001:2015, ISO/IEC 27001:2022 and SOC 2 Type 1 compliance materials.Read 15 Oct 2026 · security.netwitness.com
Security controls
The Trust Center lists audit logging, database-encryption configuration, penetration-test reports, backups, encryption at rest and encryption in transit.Read 15 Oct 2026 · security.netwitness.com
SIEM
The SIEM module centralizes logs from IT, public-cloud and SaaS sources to detect suspicious activity and support compliance.Read 15 Oct 2026 · netwitness.com
SIEM compliance
The SIEM page says it provides prebuilt reporting templates and use cases for SOX, PCI, HIPAA, and NERC.Read 8 Oct 2026 · netwitness.com
SIEM integrations
NetWitness SIEM says it ingests logs from over 350 sources, including AWS, Azure, Office 365, and Salesforce, using protocols such as Syslog, ODBC, SFTP, FTPS, and SNMP.Read 8 Oct 2026 · netwitness.com
SOAR
The platform automates incident-response processes while retaining human oversight for complex decisions.Read 15 Oct 2026 · netwitness.com
System requirements
The endpoint agent guide lists Windows 7/8/8.1/Server 2008 R2 through Server 2022, Ubuntu 16.04/18.04/20.04, Oracle Linux 8.8, AlmaLinux 9 and macOS 10.10 through 11.Read 15 Oct 2026 · community.netwitness.com
Target customers
NetWitness describes its threat detection and response solution as designed for large, complex enterprises and says it serves enterprise and government customers.Read 8 Oct 2026 · netwitness.com
Threat analytics
The platform describes using machine learning and behavioral analytics to identify known and unknown threats and anomalous behavior.Read 8 Oct 2026 · netwitness.com
UEBA analytics
Unsupervised machine learning and peer-group analytics establish user and entity behavior baselines within hours without manual algorithm tuning.Read 15 Oct 2026 · netwitness.com

Plans and prices

NetWitness Platform Priced on request custom pricing · deployment scale and data volumes determine configuration · support options available on request Read 15 Oct 2026 · external.pi.gpi.aws.gartner.com

Every NetWitness Platform plan and price →

Strong points and limits

Strong points

  • NDR uses full packet capture
  • SIEM ingests logs from over 350 sources
  • Supports on-premises, virtual, and cloud deployment
  • EDR scales to 100,000 endpoints
  • Real-time alerting included

Limits

  • Pricing is available only on request
  • Designed for large, complex environments
  • Deployment spans multiple platform models
  • Endpoint scale is described, not guaranteed

Who it suits

NetWitness describes the platform for large, complex enterprises and says it serves enterprise and government customers. It suits organizations combining network, endpoint, log, behavioral, and response capabilities.

Verdict

NetWitness combines broad detection modules with packet visibility, large-scale log ingestion, and compliance reporting. Its enterprise focus and request-based pricing call for a detailed deployment and commercial discussion.

Where Specifiction places it

Alternatives to NetWitness PlatformAll alternatives →