Microsoft Defender for Business vs NetWitness Platform
Microsoft Defender for Business
microsoft.com
NetWitness Platform
netwitness.comSide by side
| Figure | Microsoft Defender for Business | NetWitness Platform |
|---|---|---|
| Price from | $0.25/mo | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | — | Yes |
| iOS | Yes | — |
| Android | Yes | — |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 4 | 1 |
| Spec score · User and Entity Behavior Analytics Software | 8.7 (#1) | 8.1 (#3) |
| Spec score · SIEM Software | 8.6 (#3) | 8.0 (#11) |
| Spec score · Security Information and Event Management | 8.5 (#4) | 8.0 (#9) |
| Headquarters | Redmond, Washington, United States | LinkedIn lists Boston, Massachusetts as headquarters. |
| Integrations | The product integrates with Microsoft 365 Lighthouse and can work with remote monitoring and management tools and professional services automation software. | The product advertises plug-and-play connections with SIEM, NDR, SOAR, cloud and endpoint platforms plus third-party security tools. |
| Purpose | Microsoft Defender for Business is an endpoint security solution for small and medium-sized businesses with up to 300 users that helps protect devices from ransomware, malware, phishing, and other threats. | NetWitness is a threat detection, investigation, and response platform for complex IT and OT environments. |
| Support | Microsoft's Defender for Business documentation provides a guide for getting help or contacting support. | NetWitness says it offers multiple levels of technical support and a customer community with Q&A, documentation, downloads, product updates, and training. |
Plans
Microsoft Defender for Business
- Microsoft Defender for Business$3 a month
- Microsoft Entra Internet Access$5 a month
- Microsoft Entra Suite$12 a month
- Microsoft Defender for Business$3 a year
In their own words
Microsoft Defender for Business
Microsoft Defender for Business has no write-up on Specifiction yet; its figures are above.
NetWitness Platform
NetWitness Platform is a threat detection, investigation, and response platform for complex IT and OT environments. Its modules include network detection and response, endpoint detection and response, SIEM, SOAR, and UEBA, with additional OT security coverage described. NDR uses full packet capture and metadata analysis to monitor infrastructure and reconstruct sessions. Machine learning and behavioral analytics are described for identifying known and unknown threats and anomalous behavior, with real-time alerting. SIEM ingests logs from over 350 sources, including AWS, Azure, Office 365, and Salesforce, through Syslog, ODBC, SFTP, FTPS, and SNMP. It provides reporting templates and use cases for SOX, PCI, HIPAA, and NERC. SIEM can run on-premises, virtually, or in the cloud, including AWS and Azure. The EDR agent is described for hundreds to 100,000 endpoints with near-zero end-user impact. NetWitness is paid, supports Linux, self-hosted, and web deployments, and lists pricing on request.