NetWitness Platform vs Security Vision UEBA

NetWitness Platform is a threat detection, investigation, and response platform for complex IT and OT environments. Its modules include network detection and response, endpoint detection and response, SIEM, SOAR, and UEBA, with additional OT security coverage described. NDR uses full packet capture and metadata analysis to monitor infrastructure and reconstruct sessions. Machine learning and behavioral analytics are described for identifying known and unknown threats and anomalous behavior, with real-time alerting. SIEM ingests logs from over 350 sources, including AWS, Azure, Office 365, and Salesforce, through Syslog, ODBC, SFTP, FTPS, and SNMP. It provides reporting templates and use cases for SOX, PCI, HIPAA, and NERC. SIEM can run on-premises, virtually, or in the cloud, including AWS and Azure. The EDR agent is described for hundreds to 100,000 endpoints with near-zero end-user impact. NetWitness is paid, supports Linux, self-hosted, and web deployments, and lists pricing on request.

Security Vision UEBA builds behavioral models for users, accounts, devices, hosts and processes, then detects deviations in activity and traffic. Its analysis combines correlation rules, statistical methods and machine learning to identify suspicious behavior and incidents. It can analyze raw data from data lakes, SIEM, next-generation firewalls, proxy servers, and Windows or Linux devices. Configured connectors support SIEM systems, Cisco, CheckPoint, Palo Alto and Juniper network devices, Squid and Blue Coat proxies, Kafka, Elasticsearch, and Windows and Linux logs. Users can add or adapt Sigma and correlation rules with a correlation rule editor. UEBA can enrich incident data and send events or incidents to SOAR or SIEM. Response actions can include adding entries to NGFW blocklists or SIEM active lists. Its API provides alarms, suspicious events and object alerts. Deployment is on premises; the maker says its machine-learning models run on customer infrastructure without sending data to the cloud. It is paid with individual pricing, and license type and support level affect cost.