Trellix Network Detection and Response

I am working with Trellix Network Detection and Response  as part of my overall experience with these products today.

Trellix Network Detection and Response  is used for threat and response use cases for my clients. The solution correlates telemetry data from the endpoint or security solution, providing a single click of workbook and workbenches in the console for best visibility of root cause. After reviewing the workbenches and workbook, I create the playbooks accordingly, severity-wise.

The threat intelligence feature is helpful for full threat investigation. When I receive major detections from Trellix Network Detection and Response, I initiate some queries from the threat intel, and the threat intel shares with me the verdict and threat severity, which can be critical or high.

Forensic analysis is helpful because I need to collect some infections from infected machines. I first need to determine what the initial root impact machine is and the impacted network. It helps determine where the threats are coming from, and the forensic insights assist in this investigation.

As a partner of Trellix, I believe the biggest advantage of this NDR solution is that it integrates with the network side. After that, it collects all traffic for the threat capability of Trellix Network Detection and Response, such as lateral movement and C&C callbacks. Ransomware detection allows me to initiate and analyze the logs for the threat model of Trellix Network Detection and Response, then it will respond.

I am working with the threat intelligence feature for threat intelligence and threat queries, and I review through the threat intelligence.

It is effective for Trellix Network Detection and Response to integrate with other security products. ePO integrates for some security solutions such as Microsoft. There is the capability of third-party integration and ingesting the telemetry from the security solution, showing me the workbench workbooks.

Automated responses help me minimize security threats with the playbook creation and automation.

Detailed forensic analysis helps me understand network threats in general.

Trellix Network Detection and Response solution is easy to scale. I need to integrate with the main core switch, and after that, it helps with the port mirroring for threat detection.

The negative aspect is support. When I need urgent support from Trellix, there is a response after four hours or three hours, which is my main concern regarding the negative point of Trellix Network Detection and Response. Support is the only disadvantage I see.

I have been dealing with this product for around six years or more.

I am not facing any challenges of downtime at this time.

For support, I would rate it seven.

There is a difference when comparing Trellix Network Detection and Response with other competitors. For instance, Trend AI is not capable of the APT security provided, but Trellix Network Detection and Response gives us the APT solution.

I would say deployment is easy.

It is a money-saving solution, and I see ROI here.

The price for Trellix Network Detection and Response is reasonable. The pricing is reasonable, and I do not need to bargain with Trellix or customers.

I am dealing with two major vendors today, and I am still working with all of them. I work with Trellix Network Detection and Response as a reseller, and I am both a partner and a reseller selling it. It shows me the threat vector. I am not sure which feature should be added at this time. I am working on both solutions, on-premises and on cloud. I deploy on Trellix Cloud Workload Security . I have not worked with anything from AWS Marketplace  right now. My review rating for this product is nine out of ten.

My main use case for Trellix Network Detection and Response  is providing support for our customers, and one of our customers has Trellix, so we had to provide monitoring or specific XDR  tools for that customer, including Trellix, Crowdstrike, and many others.

A typical task or incident I have handled using Trellix Network Detection and Response  demonstrates that it is a very good tool for XDR , very comfortable to use, and extremely easy to use, making it one of the best XDR tools.

The best features Trellix Network Detection and Response offers include very good threat detection, and I believe that it is one of the best XDR tools. For example, ePO and XDR components are very comfortable and similar to many other tools for this type of monitoring, and I have received very good feedback for this tool.

What makes Trellix Network Detection and Response stand out for me compared to other tools is the way you can detect threats. It is very easy and comfortable to use, and the detection shows clearly on the screen, which is very easy to understand.

Regarding the features, I think that the integration with other platforms is very comfortable with the customer because we can integrate it with any switch or firewall, and it is comfortable to add this tool.

Trellix Network Detection and Response has positively impacted my organization as I have improved my knowledge about detection and response. I have already used some other tools such as CrowdStrike and Umbrella , but Trellix is one of the best that I have tested.

I believe that for my organization, Trellix has helped a lot with detection and supported our customers effectively.

Trellix Network Detection and Response is a great tool that integrates with a lot of security tools such as Palo Alto, which is a good firewall. If you have these types of tools, your organization would benefit greatly.

I would like to see in Trellix Network Detection and Response more explanation about some details of the threat, and I wish it had more actions that you can take to contain the host or move it somewhere else.

I have been using Trellix Network Detection and Response for a couple of months, possibly around six months, and I believe that it is a good tool and a very good XDR tool.

Trellix Network Detection and Response is stable in my experience.

The scalability of Trellix Network Detection and Response is very great.

The customer support for Trellix Network Detection and Response is great.

I previously used another solution, but Trellix was my first XDR tool. Then, I used CrowdStrike and Umbrella .

I think my comments about the return on investment are the same that the customers think.

My experience with pricing, setup cost, and licensing for Trellix Network Detection and Response is very great.

I did not evaluate other options before choosing Trellix Network Detection and Response.

My advice for others looking into using Trellix Network Detection and Response is to remember the actions that can be added for the SOC team. I would rate this review as a nine out of ten.

The primary use case for Trellix Network Detection and Response  is network intrusion detection, which is crucial for protecting environments. It helps secure networks and defend against phishing and other attacks created by the networking sector. We use the solution for detection and forensics investigation, reporting incidents such as the source and network path of attacks.

Trellix NDR provides an essential defense by automatically responding to network incidents that firewalls may not catch. When users break firewall rules, the solution identifies affected areas for immediate action, helping determine the actual reason for attacks. Its ability to report incidents like network paths makes it invaluable in securing the environment. With eight years of experience, I can attest that Trellix NDR is effective in detecting and protecting networks.

The Trellix solution could be improved by enhancing the Central Management Console for faster visibility, which would help in network detection response. Networking often involves complexity that could be simplified. More visibility in the dashboard would help in quickly identifying and responding to incidents. Additionally, there should be improvements in AI intelligence, faster decision-making, and a more responsive technical support team.

I have been using Trellix NDR for approximately eight and a half years.

Technical support needs improvement as sometimes engineers are not available promptly, especially during high-severity incidents. There is a need for technical expertise, specifically in device control and DLP  issues.

The initial setup of Trellix NDR has some complexities, particularly when dealing with big organizations' network design and path.

While I do not handle pricing directly, it is known that there is a variety of customers with different licensing needs, which depends on the organization's size and policy.

Currently, I would rate Trellix NDR as an eight out of ten. There are various opportunities for improving its response capabilities and dashboard visibility to quickly address incidents, which could improve the overall effectiveness of the solution.

The tool helps to reduce client risks.

Trellix Network Detection and Response helps increase response to attacks. One benefit is increased visibility and simplicity in maintaining it. AI analyzes and relates data based on past performance over the last five days.

The solution's support needs to improve their support.

I have been working with the product for two years.

The tool is stable. However, it has some monthly limitations.

Trellix Network Detection and Response differs from other products due to its integration.

Trellix Network Detection and Response's deployment is easy and can be completed in a minute.

My team helps with the tool's deployment.

I would recommend the product to others. I rate it a nine out of ten.

I use the solution in my company's daily operations to conduct threat investigations.

The most valuable feature of the solution stems from how it allows users to do the investigation part. Another important part of the product that is valuable is associated with how it gives information to users in the form of a storyline.

In Trellix Network Detection and Response, I suggest having Trellix EDR like features as it currently does not have the feature to add multiple IOCs to search an environment. If you want to search the hashes in the environment, you need to put in IOCs one by one, making it a very hectic job. In my company, we have to use IOCs daily to search for hashes in our environment, and then we have to put in the IOCs one by one. My company had spoken to Trellix's team to look into the matter concerning IOCs and was told by Trellix that the tool doesn't have a search feature that allows the use of IOCs in one go. The aforementioned area needs improvement in Trellix.

I have been using Trellix Network Detection and Response for two years. I am a user of Trellix.

The product sometimes crashes, but it is up and working most of the time. In general, there is some downtime and certain issues with the product.

I use the product daily in my company.

Multiple people in my company use the product.

In my company, if you face issues with Trellix Network Detection and Response or Trellix EDR, there is a separate team in my organization that offers technical support.

I have almost four years of experience in the area of cybersecurity, and I have used many EDR solutions before Trellix, like Kaspersky and Cybereason. My company decided to use Trellix Network Detection and Response.

I rate the product's initial setup phase a seven on a scale of one to ten, where one is difficult, and ten is easy.

The solution is deployed on an on-premises model.

The product's response capabilities were good. In general, I can say that the solution's response capabilities are neither too good nor very bad, so I can place it somewhere in the medium range.

I rate the tool a five out of ten.