LogSentinel SIEM vs NetWitness Platform
LogSentinel SIEM
logsentinel.com
NetWitness Platform
netwitness.comSide by side
| Figure | LogSentinel SIEM | NetWitness Platform |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · SIEM Software | 7.8 (#13) | 8.0 (#11) |
| Deployment | The maker describes cloud and on-premises deployment options, including a zero-setup cloud SIEM and an open-source collector and agent. | The SIEM page lists on-premises, virtual, and cloud deployment, including AWS and Azure. |
| Integrations | Data sources include AWS, Microsoft Azure, Google Cloud Platform, Microsoft 365, Okta, Salesforce, Oracle, Microsoft SQL Server, and syslog sources. | The product advertises plug-and-play connections with SIEM, NDR, SOAR, cloud and endpoint platforms plus third-party security tools. |
| Purpose | LogSentinel SIEM provides security monitoring with threat detection and response for the mid-market. | NetWitness is a threat detection, investigation, and response platform for complex IT and OT environments. |
| Support | Email and phone support are included in the license, according to the features page. | NetWitness says it offers multiple levels of technical support and a customer community with Q&A, documentation, downloads, product updates, and training. |
Plans
LogSentinel SIEM
- Enterprise SAASPriced on request
- On-Premise InstallationPriced on request
In their own words
LogSentinel SIEM
LogSentinel SIEM is a security monitoring system for mid-market organizations, available through web, API, Linux, Windows, and self-hosted deployments. It gathers logs centrally, aggregates and normalizes them, and supports custom connectors plus agentless collection. Detection combines rule correlation, machine-learning analysis, threat intelligence, threat hunting, and phishing detection. Incident tools cover investigation, triage, notifications, and automated response, with custom rules and real-time alerts. Sources include AWS, Microsoft Azure, Google Cloud Platform, Microsoft 365, Okta, Salesforce, Oracle, Microsoft SQL Server, and syslog. The collector also accepts REST APIs, text files, Windows logs, and database tables. Security features include log integrity, digital evidence, and end-to-end encryption. Compliance reports address GDPR, HIPAA, SOX, PCI-DSS, and PSD2. Cloud and on-premises options are offered, alongside MSSP use cases. Pricing is on request; a free plan and trial are listed.
NetWitness Platform
NetWitness Platform is a threat detection, investigation, and response platform for complex IT and OT environments. Its modules include network detection and response, endpoint detection and response, SIEM, SOAR, and UEBA, with additional OT security coverage described. NDR uses full packet capture and metadata analysis to monitor infrastructure and reconstruct sessions. Machine learning and behavioral analytics are described for identifying known and unknown threats and anomalous behavior, with real-time alerting. SIEM ingests logs from over 350 sources, including AWS, Azure, Office 365, and Salesforce, through Syslog, ODBC, SFTP, FTPS, and SNMP. It provides reporting templates and use cases for SOX, PCI, HIPAA, and NERC. SIEM can run on-premises, virtually, or in the cloud, including AWS and Azure. The EDR agent is described for hundreds to 100,000 endpoints with near-zero end-user impact. NetWitness is paid, supports Linux, self-hosted, and web deployments, and lists pricing on request.