Symantec Protection Engine for Cloud Services on Linux

My major use case for Symantec Protection Engine is the protection of our endpoints and servers. We have Red Hat Linux servers, Windows servers, and Windows desktops and laptops, and I protect all of them. We have Oracle Database, MySQL, and Postgres servers running on the RHEL platform, along with various websites. We used to protect the servers through the Symantec protection suite. We also protect desktops running various versions of Windows, such as Windows 10 and 11.

What stands out is that a ransomware attack has never happened in my environment since we adopted the solution. That is the biggest advantage, and it applies to ransomware and any other attacks. Previously, a couple of attacks happened in my environment. After procuring Symantec and renewing it, we have never faced any attack events.

The console is excellent for centralized control. Through it, I can push policies, update signatures, manage the entire network, and remove access. This is a fantastic feature, and I feel it is a great asset. Policies and endpoint firewalls can also be pushed, and endpoint exclusions for some applications can be whitelisted. These features are very nice for a system admin because they allow for better management. For example, if my Oracle is not patched, the Endpoint Protection Suite enables virtual patching. That is one of the biggest features and provides great value.

Content scanning is very important to me, and it helps with threat detection. Content scanning has a great advantage at the memory level and in real-time memory use cases. It has a product for content scanning and real-time memory, and it even detects DLL files and some rootkits. For instance, it is fantastic against Linux server rootkits. That is why I have not found any attacks recently. I use all of this for my production workloads, where the servers I mentioned handle more than 2 lakh to 3 lakh users and are protected with the Symantec protection suite.

I find it quite seamless to integrate Symantec Protection Engine with IT infrastructure. It is very easy to integrate, and there is no doubt about it. Integration is significant to me, and I see benefits in this capability. The integration I am referring to is with IT infrastructure and potentially with third-party applications. Since this protection suite is installed on the respective host machines, I add policies according to my use case. It supports various platforms, and in my environment, I have only Red Hat Linux, Windows, and Windows desktops. Therefore, I do not have any challenges integrating this protection suite.

Policy management is very important to me because I have different use cases with different servers and applications running on them. I create various profiles and manage workloads effectively with the help of policy management. It allows me to create different policies and push them to different categories or groups of workloads. I have Windows Active Directory workloads, DNS workloads, Apache workloads, and more. This capability is fantastic for managing my workloads.

Threat intelligence is effective for protecting against some threats. Since there are primarily no problems in my environment, I think it is perfectly fine.

High-performance scanning has an impact on my operational efficiency. I find this a little drawback in Symantec Protection Engine because it throttles a lot of CPU. It consumes a lot of resources when I perform content scanning. If I do a complete scan, whether on a server or through real-time scans, especially when dealing with huge files, it takes up a lot of CPU. Until the scan completes, this becomes a bottleneck. Otherwise, it is okay because protection-wise, there is no doubt. I do not find any major attacks in my environment.

I see room for enhancement in Symantec Protection Engine. I do not think they have a properly developed SIEM and SOAR product. I feel file integrity monitoring is a crucial feature, and Symantec does not provide this capability in the protection suite I am using. If anyone changes a file, there is no tracking of that, and I find this aspect quite important. Also, scanning uses a considerable amount of resources on desktops and servers, which leads me to schedule scanning only during non-peak hours. This becomes a real challenge because the production workload runs 24/7, which necessitates careful planning.

I started working with Symantec Protection Engine quite some time ago, and we have been using it from 2008 or 2009 onwards. I used it personally until about one and a half years ago. It is still under use.

I find Symantec Protection Engine to be very good and stable, and I do not encounter any problems.

In terms of scalability, I feel upgrading poses challenges. While my uses are defined, upgrading is not that easy. I have previously encountered challenges with the upgrade process, which necessitates that my team always submit support tickets. Adding more nodes onto the existing console presents no challenges.

The technical support is generally good, but getting a ticket resolved can be tough. I find their direct call facility lacking, as I must call through their portal. This aspect could be improved.

If I had to rate support on a scale from zero to ten, I would give them a seven. I cannot give more than that.

I find Symantec Protection Engine very easy to install and deploy. I have installed it even on my Red Hat Linux servers.

I think tracking ROI with Symantec is feasible. The best aspect for me is the time and money saved because my production workload has not been affected to this day. That represents a substantial return on investment.

Regarding price, I think it is comparable to Trend Micro, so I find it quite equal. However, I also use Trend Micro Apex One for some workloads for a few users in my environment.

In terms of technical comparison between Trend Micro and Symantec, I find Trend Micro to have more advanced features. Trend Micro has additional features, such as file integrity monitoring, as part of its protection suite. I consider this very important for my workload, especially in a data center environment where multiple guest operating systems are running. I need this monitoring for file integrity on those servers. In terms of capabilities, I do not have experience with the Symantec Data Center edition, but I believe Trend Micro excels in this area.

Trend Micro also provides certain Web Application Protection capabilities to combat SQL injection and cross-site scripting attacks, though Symantec requires a separate product for full WAF capabilities. In comparing the IPS engines of both products, I found Trend Micro to be slightly better, enabling fine-tuning at the application layer, while Symantec lacks some of this capability. Overall, I would rate Trend Micro five stars and Symantec about 4.5 stars.

For my final rating of Symantec Protection Engine, I would give it a nine overall, as the product itself deserves that rating. Support-wise, I can only give a seven.

Customers prefer Symantec Protection Engine for the licensing fees over the alternatives. The product has basic protection which is a bit lower than expectations recently, but it is an adequate product for our needs. I started working as an integrator with Symantec Protection Engine approximately 10 years ago.

As an integrator, I can say that Symantec Protection Engine is easy to integrate and serve. Licensing is cheaper than the alternatives, and it is a rock-solid product for edge mail security.

Real-time content scanning is already being used, but not with any additional content server.

For threat intelligence, I would say it has basic features. The attachment scanning feature, called disarming, is a nice feature, and we are able to describe an in-depth use of it. Other than disarming, I would not have any additional extra features that I could highlight to customers.

For emerging threats, content scanning is not enough anymore. We recently started talking about alternative products such as Proofpoint or other mail gateways which have AI features. Symantec is lagging behind these features.

We have scenarios in which Symantec Protection Engine misses some threats, spam, and targeted attacks that Proofpoint can catch with AI security features. Symantec is not the only product missing this; I also count Forcepoint in that area. It is missing and not catching the threats we hope for. We discuss a mixture of products according to customer use cases.

AI security is a big feature in this area. I am relatively new to Proofpoint compared to Symantec Protection Engine, and I have received training. The flexibility of the topology and policy arrangements in Proofpoint is more flexible than Symantec Protection Engine in some specific scenarios when directing email traffic, particularly if you understand traffic and forwarding.

Technical support from Broadcom should be better. Their response times are really late, and sometimes we are not receiving the support level that we used to have 10 years ago. I would rate the new support from Symantec at a three.

I have been using this solution for approximately 10 years.

Symantec Protection Engine is reliable but lagging behind in features.

It is easy to scale, and everything is measured in the documentation. You understand what to do, and the product itself indicates if it is low on resources. You feel the necessity to increase the resources for it when needed.

Response times are really late, and sometimes we are not receiving the support level that we used to have 10 years ago. I would rate the new support from Symantec at a three.

We have scenarios in which Symantec Protection Engine misses some threats, spam, and targeted attacks that Proofpoint can catch with AI security features. Symantec Protection Engine is not the only product missing this; I also count Forcepoint in that area. It is missing and not catching the threats we hope for.

Symantec Protection Engine is easy to install.

Symantec Protection Engine is a cheaper and rock-solid product where basic anti-spam features and threat intelligence are needed. However, if advanced threats are the focus of the customer and the sizing is bigger, and they do not prioritize pricing, we recommend other solutions instead of Symantec products. After Broadcom's acquisition, Symantec support is lagging behind, and everyone is complaining about this.

Symantec Protection Engine is affordable.

We recently started discussing alternative products such as Proofpoint or other mail gateways which have AI features.

Policy management is clear overall. One thing is a bit unclear about policy management for Symantec Protection Engine: when you create a policy but do not assign it to a group, you might think it is enabled and in use, but it is not active in that way. It must be assigned to a group to be active. This is a cosmetic issue for our organization and for customers. AI security is what I would like to see as additional features added to Symantec Protection Engine specifically. I have assigned an overall review rating of six to this product.

My clients are using Symantec Protection Engine for antivirus protection first, then malware and endpoint and USB protection, covering all of their needs.

I am using the content scanning feature in real time.

I am using the tailored policy management capability of Symantec Protection Engine, and I define groups with different policies for each, making it easy to manage. When a client needs to be added to the system, I select which group they will appear in, and the configuration is automatically added.

The biggest advantage of Symantec Protection Engine is that one tool protects all, and it is centrally managed. The support is also very good.

Integration with Symantec Protection Engine is very easy with infrastructure.

High-performance scanning is beneficial because it does not add burden on the processor or create other bottlenecks, so we have not faced any performance problems with the endpoint.

The tailored policy management capability impacts my security approach.

I see areas for improvement in Symantec Protection Engine, specifically for application management. It would be better to allow certain Microsoft products and allow Microsoft products for all. When a new update comes from Microsoft, sometimes their products are also blocked.

I started working with Symantec Protection Engine approximately twenty years ago.

Symantec Protection Engine is stable and reliable at approximately ninety-nine percent; I do not see crashes.

Scalability with Symantec Protection Engine is good because there are no limitations. You can add many servers and integrate them, making scaling easy.

Customer support from Symantec is helpful.

If I had to rate support from zero to ten points, I would give them a rating of nine.

I am not familiar with other products because I have been using Symantec Protection Engine for years, and although I sometimes check if it is a leader or not, I have not reviewed other options for a long time.

The installation part for Symantec Protection Engine is easy; you create an executable file and deploy it on all clients.

I have never purchased Symantec products from the AWS Marketplace.

A small example of return on investment with Symantec Protection Engine is that clients do not need to consider any other product because when a new area appears, such as content filtering or content management, it is already integrated into the product. Thus, they do not need to acquire a new product, and the company can add features more rapidly, saving money for the customer.

As for pricing, I would say it is a little expensive compared to competitors, and I think the vendor could achieve more market growth if the pricing were more reasonable.

Even though it is a little expensive, I see value for money with Symantec Protection Engine; it saves money.

The best features of Symantec Protection Engine are that it is the product we have been using for years, so we are very familiar with it. Installation is easy, updates are also easy, and the product is user-friendly.

The content scanning feature helps with my proactive threat detection because it is very easy; I do not need to specify which sites or IP addresses I need to protect. It checks the content by itself and asks whether I want to allow it or not, then creates a log that I can check. If I see a negative site listed in that log, I can allow it or take appropriate action. It is very easy to manage.

The threat intelligence is effective in Symantec for protecting against threats because it is intelligent.

I measure the effectiveness of Symantec Protection Engine's threat intelligence, and the benefits are evident. When traffic from a different IP address or a very different client is enormously populating, it starts blocking. It becomes easy for me to evaluate the traffic; if it is normal traffic, then I allow it. Most of the blocking is positive.

I would rate this review nine out of ten.

I mainly use Symantec Protection Engine for scanning files for malware, protecting emails, and web filtering URL protections.

I use Symantec Protection Engine to scan files uploaded by users and shared across endpoints, and it has helped identify potentially malicious files before they could spread, which makes routine monitoring and investigation much easier for my security team.

One thing that stands out about my main use case for Symantec Protection Engine is how my team uses it as part of daily endpoint monitoring, which helps us quickly validate suspicious files and reduces the time spent on manual analysis, improving overall response efficiency.

For governance and security regarding Symantec Protection Engine, from my experience, my primary use case is malware scanning, so I have limited exposure to its AI-specific features; however, from a security perspective, it has been reliable and provides the controls and visibility needed for day-to-day operations.

The best features Symantec Protection Engine offers are the malware detection engine and automated file scanning, as they help identify suspicious files quickly and reduce the time spent on manual checks.

What I value most about the malware detection engine in Symantec Protection Engine is its detection accuracy, which helps identify suspicious files reliably without generating too many false positives; the automated file scanning is especially useful for files uploaded to shared locations, as it reduces manual checks and helps my team respond to potential threats more quickly.

Symantec Protection Engine has improved my security posture by helping me identify potentially malicious files before they reach users or critical systems, and the automated scanning process has also reduced manual efforts for my team, allowing us to focus on other security tasks and respond to threats more efficiently.

I do not have specific metrics to share about Symantec Protection Engine, but I have seen a noticeable improvement in efficiency as automated scanning helps identify potentially malicious files earlier in the process, reducing the amount of time spent on manual reviews.

Symantec Protection Engine works well overall, but troubleshooting can sometimes take extra time when detailed logs need to be reviewed; other than that, my experience has been positive.

I would like to see improvements in reporting and troubleshooting capabilities for Symantec Protection Engine, as more detailed insights and simplified diagnostics would make day-to-day administration easier.

Better reporting, easier troubleshooting, and more streamlined integration with other security tools would help my team work more efficiently with Symantec Protection Engine.

I chose a rating of 8 out of 10 for Symantec Protection Engine because there needs to be improvement on things like reporting, troubleshooting, and streamlined integration with other security tools.

I have been using Symantec Protection Engine for five years.

Symantec Protection Engine has been a stable and reliable solution, as I have experienced very few operational issues, and it has consistently performed well for my malware scanning requirements.

Symantec Protection Engine has scaled well with my needs, continuing to handle increasing scanning workloads while maintaining reliable performance.

For customer support of Symantec Protection Engine, I have had limited interaction, but the experience has been positive, with professional responses that helped address my questions efficiently; therefore, I cannot provide detailed feedback on the support experience.

I used another solution previously before transitioning to Symantec Protection Engine to improve operational efficiency and simplify malware scanning within my environment.

Based on my experience with Symantec Protection Engine, the detection capability is reliable for day-to-day operations, with generally accurate results that help my team identify suspicious files more efficiently while still following standard validation procedures.

I would recommend evaluating Symantec Protection Engine against your specific security requirements and testing it in your environment, as it has been a reliable solution for malware scanning and file protection in my experience.

My overall review rating for Symantec Protection Engine is 8 out of 10.

I already worked five years with Symantec products. Not in partnership with Symantec, but in my previous companies, I worked almost five years with them, so I have experience with backups, EDR, XDR, and everything.

Symantec Protection Engine is included for both on-premises and cloud deployments. I already have the EDR with the deployment of Symantec Protection Engine.

Symantec Protection Engine is included for both on-premises and cloud deployments. I already have the EDR with the deployment of Symantec Protection Engine.

The tailored policy management capabilities of Symantec Protection Engine are good. The operational efficiency with the high-performance scanning of Symantec Protection Engine is very good. It is not too costly and not too cheap.

The seamless integration of Symantec Protection Engine is very good.

For the improvement of Symantec Protection Engine, the engine did not work with their basic engine when I was working, which was almost three or four years before. In the current world, you have to change with AI and with everything. At that time, I did not find all these things. There could be some issues with Symantec.

I am talking about the engine side. At that time when I was working, they did not work with that engine. They went with a different engine after they sold their company to another company.

The deployment of Symantec Protection Engine took a couple of hours. If you have experience with virtualization and how to install it, it is very easy. There is no issue with installation. The setup, installation, and deployment are very easy. However, they did not change with the market.

At the time when I was working, the real-time content scanning feature was not supported there with Symantec Protection Engine. There could be problems with integration with third-party tools, as they are not 100% flexible.

We were developing an in-house application, and it would create an issue. With the in-house application, when we were building everything, Symantec Protection Engine was already deployed on that server, and it still treated that machine and our application as a virus.

I used Symantec Protection Engine for almost six years continuously, until 2022.

I would rate the support of Symantec Protection Engine from Broadcom at eight. They are quick for technical support. When I create a ticket, it normally depends on the type of ticket and what we pay them. They have their own methodology, and they support me on time. For the in-house application, I opened the ticket multiple times. They gave me a workaround solution to fix it.

I did the deployment of Symantec Protection Engine myself. Currently in our environment, we are using Microsoft Azure, not AWS cloud. Before, I worked 100% with Symantec Protection Engine until 2022. There was no other antivirus for me because I truly liked Symantec—the way it worked, everything, the protection. However, as per the time changes and security increases, we needed to go with AI solutions and everything.

The deployment of Symantec Protection Engine took a couple of hours. If you have experience with virtualization and how to install it, it is very easy. There is no issue with installation. The setup, installation, and deployment are very easy.

I did the deployment of Symantec Protection Engine myself.

It is not too costly and not too cheap.

I am currently using CrowdStrike.

I prefer both on-premises and cloud deployments. I have no issue with either option. The operational efficiency with the high-performance scanning of Symantec Protection Engine is very good. It is not too costly and not too cheap. When I was working with it, I would give Symantec Protection Engine a rating of seven. I purchased this solution through some other vendor, not through AWS Marketplace. They gave me a workaround solution to fix it. I would rate this solution an overall eight.