Endpoint Protection - Screw Gartner, let’s get honest and talk Good, Bad, and Ugly on products and vendors - Who’s the worst, and who’s your favorite?
Which of these EDR solutions would be the best to use?
Need opinions and experiences on EDR/XDR platforms
What is Network Detection and Response?
Network detection and response (NDR) products detect abnormal system behaviors by applying behavioral analytics to network traffic data. They continuously analyze raw network packets or traffic metadata within internal networks (east-west) and between internal and external networks (north-south). NDR products include automated responses, such as host containment or traffic blocking, directly or through integration with other cybersecurity tools. NDR can be delivered as a combination of hardware and software appliances for sensors, some with IaaS support. Management and orchestration consoles can be software or SaaS.
What is Extended Detection and Response?
Extended detection and response (XDR) delivers security incident detection and automated response capabilities for security infrastructure. XDR integrates threat intelligence and telemetry data from multiple sources with security analytics to provide contextualization and correlation of security alerts. XDR must include native sensors, and can be delivered on-premises or as a SaaS offering. Typically, it is deployed by organizations with smaller security teams.
Videos
This can be completely subjective, but, share your thoughts and context such as what’s great for massive enterprises and small shops, good budget/no budget, HALO products and vendors, and those to be avoided no matter the org.
For instance, I’ve never had a good experience with Trend or Sentinel… have others? What are your thoughts and experience supporting EDR?
Thanks!
I'm deciding between
crowdstrike Falcon
Sentinelone Singularity Complete
VMware CarbonBlack EDR
Microsoft Defender for Endpoint
TrendMicro XDR
This is for around 50 devices, also which would be the cheapest overall?
The place I work at currently uses ESET Protect as the endpoint protection platform and before renewing our licenses we are deciding if we need to switch from ESET into something like SentinelOne or Defender 365. We’re in the process of ramping up the organisation’s security as well starting next year and that is one of the reasons why we’re considering this switch as well.
Our ecosystem consists mostly of Windows PCs and servers, very few Linux servers, and also some Android devices, we got Office 365, and also got some infrastructure in Azure cloud as well. The top two contenders for me right now are Defender 365 (because of the footprint MS has on us and also because the whole ecosystem will integrate well), and SentinelOne. Crowdstrike (even though I like the product) didn’t make it because our higher-ups are still uneasy with their outage incident.
How are your experiences with these two products? Would love to hear about out-of-box protections, fine-tunings and integrations, support, and administration.
And also regarding ESET, they’ve served us well over the years. I think the company is looking for something ‘modern’ but I did my research and it seems like all these products do the exact same thing.