Darktrace

My main use case for Darktrace  is to identify remote connections and abnormal connections such as FTP or any kind of RDP happening inside our LAN network or company network, where we want to verify the data transfers and check if any abnormal user is transferring data through the network to the outside, or any kind of suspicious activity.

One specific example of a situation where Darktrace  helped me spot something unusual is when one of the employees tried to copy some of his data to the outside. He is a developer trying to implement an application in a cloud environment, and while he was copying his file from inside our network to a cloud network, we got an alert, which we considered significant because he had not done it earlier, as it was an initial step in his developing environment. Because of that alert from Darktrace, when we checked with him, it was actually a legitimate activity.

Darktrace impacts my organization positively by providing us with a better understanding of abnormal activities detected among users.

The positive impact includes helping us identify a lot of transfers and abnormal activities, as some users try to perform RDPs inside our network, using LAN for different desktops or laptops, making it quite useful to identify users, especially those from a non-technical background.

In my understanding, the best feature Darktrace offers is the identification of copying files, which acts as a DLP , and it is a main concern for companies because users sometimes copy data outside without knowing, especially those without a technical background.

When I mention the DLP-like feature and file copying detection, the alerts have been very timely, as we get an alert within a couple of minutes, which is excellent. Even if some developers are working after hours and copying files, our SOC team detects this, and most of the time they call us so we can identify the users. The alerts are quite accurate and proactive.

As of now, I feel Darktrace can be improved to better detect end device activities, such as laptops or desktops, to bind it with our network.

I have been using Darktrace for around two years.

Regarding scaling, we initially planned for 2,000 to 4,000 devices, but we did not add any additional licenses for more devices after implementing Darktrace.

The customer support from Darktrace is good. We reached out to them a couple of times to check on some features, and they helped us very effectively.

Integrating Darktrace with our existing security tools was not difficult at all. We simply SPAN our core network port into the Darktrace side, and we did not face any difficulties at that time.

In terms of the interface and reporting, I believe Darktrace is good. I have also worked with ExtraHop, and compared to them, I feel Darktrace is way ahead, so I do not have any improvement suggestions for reporting views.

Darktrace is a very good tool, and we introduced it after we had an incident in a previous company, where we faced an attack and that is when we introduced this tool, which helped us identify a lot of abnormal activities, mainly from our developing team. My company is quite large with around 8,000 employees and they are developing a lot of things without our knowledge.

Although I do not have exact numbers, I can say that our security posture has improved a lot since implementing Darktrace, especially as our SOC team monitors the activities and we communicate with users about the need to stop certain activities.

During my time at the company, we did not find any zero-day threats or unusual attacks, but we noticed certain abnormal activities done by users.

My advice for others looking into using Darktrace is that for large-scale companies with huge teams, especially developers working separately from the system teams, it is crucial to implement security measures, as sometimes the most vulnerable positions come from those in technical backgrounds who can create security loopholes. In such environments, having tools Darktrace is essential to improve the organization's security posture without compromising their reputation. I would rate this product a 9 out of 10.

Regarding the autonomous response feature, I appreciate how it functions within the platform.

Based on my experience, I believe the solution could be improved in some areas, and there are certain drawbacks that I have encountered.

I have been working with Darktrace  for approximately one to one and a half years or longer.

In general, I would say that the interface of Darktrace  is intuitive enough, and it aids in understanding threat landscapes and attack paths.

Regarding scalability, I would rate it eight points.

If asked to rate Darktrace support on a scale from zero to ten where ten is the best, I would give them five points.

Regarding the installation and initial setup, I found it to be straightforward rather than complex.

Concerning pricing for the product, I would say it is somewhat expensive.

I have rich experience with many tools including Vectra, Cisco firewall, and Check Point.