Red Canary Managed Detection and Response

My main use case for Red Canary is to watch our computers and servers for any suspicious activity. The biggest value for us is that we don't have to sit and watch security alerts all day as we previously did. Red Canary monitors the environment and brings something to our attention when it looks like a real threat. For example, if an employee accidentally opens a suspicious attachment and it starts running PowerShell or an unusual process, Red Canary can follow what happened instead of just showing us one alert. We can see what started the activity, what happened next, and whether anything else was affected.

On a normal day for me, I am mostly checking the alerts and investigations that Red Canary has raised. If something is marked as suspicious, I look at the timeline and details around the activity. Sometimes it turns out to be normal employee activity, so we close it. If it looks malicious, we investigate further and take action on the affected machine or account. We also use Red Canary when our other security tools raise an alert, and it is helpful at getting more context instead of making us investigate every alert from scratch.

Another thing I appreciate about Red Canary is 24/7 monitoring. If something happens at night or over the weekend when I'm out of office, Red Canary still gives us what is happening and gives us an alert. We don't have to wait until I or our team come back to work. Typically that is how we use Red Canary at our organization.

This happened two months back when Red Canary flagged an unusual PowerShell activity on one of our employee laptops. The user had opened an attachment from an email, and shortly after that, a PowerShell process started running in a way that was not normal for that user. Red Canary showed us the sequence of events and alerted us on that malicious incident.

The best features that Red Canary offers is the attack timeline. For example, if a suspicious file is opened, we can follow what happened after that, what process started it, and what other activity followed, and whether the machine made unusual connections. We can see those events, which makes investigations much easier.

I also appreciate the 24/7 monitoring. We don't have to depend completely on our team or me being available. If something suspicious happens outside our working hours, Red Canary can investigate it and escalate it to us when action is needed.

The feature I had forgotten to mention, and we use it mostly, is the threat detection. When Red Canary sees something unusual, it doesn't give us just an alert. It gives us more information about what happened and activity around it.

The biggest impact that Red Canary has had for us positively is reducing the amount of time I and our team spend investigating security alerts. When we were using traditional antivirus tools, we could spend a lot of time collecting logs and checking different tools just to understand whether an alert was actually malicious or not serious. With Red Canary, we can get the investigation context and timeline much earlier. For example, for a normal endpoint alert that could take us sixty minutes or one hour to investigate, it can be understood within less than five minutes.

To improve Red Canary, I think we should improve the alerts. Red Canary does a good job when identifying suspicious activity, but sometimes in a busy environment, I would appreciate a feature whereby it can separate urgent threats from threats that can wait. This would reduce the amount of time we spend reviewing lower-risk cases.

Another improvement would be a faster investigation process. For example, simple alerts have straightforward investigations, but complex incidents require us to look through a lot of information to determine what is happening.

I have been using Red Canary for two years.

Red Canary has been quite stable for us. The monitoring generally runs in the background without causing noticeable problems for our endpoints, and it doesn't disrupt our normal work.

Red Canary has scaled well for us. As we added more endpoints and users, it has scaled well.

Customer support for Red Canary is good and better than I expected. The support team is always there for us to help us mitigate any security incident we get when we receive a suspicious alert and are not sure what to do next.

I would rate the customer support an eight out of ten because sometimes more complex cases take a day or longer to be solved.

We did not use any previous solution.

There has been a reduction in time needed to investigate a typical endpoint alert. The average investigation time dropped almost up to five minutes for common cases. We also save good hours, around eighty hours saved per week for me and my security team on alert investigation.

We got back roughly around seventy thousand dollars per year. The biggest saving came from analyst time, and we estimated saving about two hundred and forty hours per year on alert triage and initial investigations. At an estimated cost of our internal security labor around sixty dollars per hour, that is approximately fourteen thousand dollars saved annually.

For our environment, we are paying roughly thirty-five thousand to sixty thousand dollars per year for Red Canary. The actual cost depends mainly on the number of endpoints we are monitoring and the level of managed detection and response coverage we need. When I look at the cost, I don't compare it only with any other security product because it is a bit expensive, but it provides for us a 24/7 monitoring and investigations. The way it saves us time, it is worth an investment.

Before choosing Red Canary, we evaluated Microsoft Defender for Endpoint and CrowdStrike for endpoint. We decided to go with Red Canary.

My advice to others looking into using Red Canary is to start with a small group of important endpoints and then run them. Don't just look at how many alerts Red Canary has given you. Instead, look at whether the alerts are useful and whether the investigation actually saves your team time. I also advise connecting Red Canary to the security tools you already use, as it becomes more useful when Red Canary scans the entire environment. I would rate this review an eight out of ten overall.

Public Cloud

Amazon Web Services (AWS)

What do you like best about the product?

Red Canary is a helpful solution that offers brilliant threat detection and this makes it easy to identify security challenges
The software handles and manages SOC processes, and this includes active monitoring and proper security alerts
Red Canary reduces chances for false positives and this makes the entire security process successful
The app provides robust remediation procedures and guidance, which makes the users more solid and efficient
The app connects with Microsoft Defender and this helps in improving security visibility
Red Canary has remarkable threat intelligence capabilities and this helps in identifying and learning threat patterns

What do you dislike about the product?

Red Canary has premium pricing, something that makes small businesses ignore it and prefer to others
The customization of a dashboard is inflexible and this affects companies performance

What problems is the product solving and how is that benefiting you?

The software is outstanding in detecting all threats and vulnerabilities, creating a reliable work environment
The program issues 24/7 systems and incidents monitoring, and this amplifies the response speed
When attacks appear, Red Canary is fast to offer reliable remediation and recovery
The visibility of ant endpoint status and cloud protection is also well addressed by this software
The program saves on time that can be used for triaging security alerts and this makes companies mature their SOC operations
Red Canary offers expert analysis and this largely supports companies with less security teams

What do you like best about the product?

Red Canary is a robust managed detection and response approach that facilitates the security team to identify threats faster
Red Canary has robust reputation on sharing actionable alerts and there is no false positives, hence, the alerts shared are accurate
The program issues a detailed investigation information or report, and the appropriate remediation guide
The integration of Red Canary with items such as CrowdStrike, Microsoft Defender, among others is a versatile thing from the app
The app provides reliable customer service or feedback and it conducts knowledgeable analysis

What do you dislike about the product?

Red Canary has an expensive pricing, no small packages for small companies
Occasionally, Red Canary experiences some delays, and this gaps affects the continuity of the company

What problems is the product solving and how is that benefiting you?

Red Canary is resourceful in reducing or filtering noisy detection, where it prioritizes on actionable and real incidents
The app creates a 24/7 cybersecurity monitoring, and there is timely response to avoid damages
The app detects credential theft, ransomware, endpoint threats and cloud activities before they cause damages
The incidence report time or rate is largely supported by the app, and the remediation shared are timely and consistent
The process of threat monitoring is also a paramount factor, where it conducts proper surveillance both on cloud and across endpoints
Red Canary strengthens the security preparedness and posture of a business without extreme financial facilitation

What do you like best about the product?

It reduces the burden on internal security teams by handling alert monitoring, investigation, and validation, while providing clear and actionable findings instead of noise. This helps improve response speed and overall security confidence.

What do you dislike about the product?

One downside of Red Canary is that it can feel less flexible for advanced customization compared to building an in-house SOC. Some users may also find it limited in deep visibility or control over certain investigations since it’s a managed service.

What problems is the product solving and how is that benefiting you?

Red Canary solves problems like alert overload, lack of skilled SOC resources, and slow threat detection and investigation.