Trellix Network Detection and Response

What do you like best about the product?

I like that Trellix Network Detection and Response (NDR) simplifies alerts and reduces alert fatigue. I can see network and endpoint security blind spots, which improves our company’s security posture. I also like Trellix’s AI capabilities because they automate processes, reducing workload and the need for analysts. I found setup moderately easy: deployment is easy, but placing the sensors is the real work.

What do you dislike about the product?

The licensing cost for the AI capabilities is a bit high, and Trellix Network Detection and Response can feel fragmented, so I’d like better product consolidation. Deployment is easy, but the real work is placing the sensors.

What problems is the product solving and how is that benefiting you?

I use Trellix Network Detection and Response (NDR) to simplify alerts and reduce alert fatigue. I can see network and endpoint security blind spots, which improves our company’s security posture.

What do you like best about the product?

It is very fast and reliable, with the fastest detection and investigation, I love its SOC. Some of the information I don't know about it so I'd love to learn about it.

What do you dislike about the product?

Deployment and initial tuning takes effort and the UI could be more intuitive. Support response times could also be improved, and the cost is a bit high compared to alternatives, but once tuned it performs well.

What problems is the product solving and how is that benefiting you?

Trellix NDR solves our lack of visibility into network threats and advanced attacks like zero-days and lateral movement. It gives us real-time detection and faster investigation, which has reduced our response time and improved our overall security posture.

What do you like best about the product?

What I value most about Trellix Network Detection and Response (NDR) is its focus on network visibility and threat detection, which are essential for identifying suspicious activity and supporting effective cybersecurity operations. The ability to investigate potential threats, understand network activity, and support timely incident response is particularly important for organizations facing increasingly sophisticated cyber risks. A solution that brings these capabilities together can help security teams make informed decisions and strengthen their overall security posture. I would place particular emphasis on its detection accuracy, ease of use, integration with existing security tools, and effectiveness in real-world situations when evaluating its overall value and deciding whether to recommend it.

What do you dislike about the product?

One area I would pay attention to is the overall ease of deployment, configuration, and ongoing management. As with network security solutions generally, integration with existing infrastructure and the time required to investigate alerts can affect the user experience. Clear documentation, an intuitive interface, and straightforward workflows are important for helping security teams work efficiently. I would need more hands-on experience to identify any specific shortcomings in Trellix NDR and assess how well these areas are addressed.

What problems is the product solving and how is that benefiting you?

Trellix NDR helps address the challenge of detecting suspicious network activity and investigating potential security threats. For example, identifying unusual network traffic can help a security team investigate a possible threat before it causes greater disruption. This can support better visibility, faster response, and improved network security.

What do you like best about the product?

I like the visibility Trellix Network Detection and Response (NDR) provides into network activity. It allows me to understand the bigger picture during a security incident. The network activity and connection details are especially useful because they give me quick context.

What do you dislike about the product?

I think the main area I would improve is the alerting experience. Some alerts can require extra investigation to understand their importance. So clearer prioritization and more concise context would make the response process faster.

What problems is the product solving and how is that benefiting you?

I use Trellix Network Detection and Response (NDR) to monitor network activity, spot potential threats, and understand incidents better. It gives us visibility beyond endpoint alerts, providing context about unusual connections and helping us investigate security threats effectively.

What do you like best about the product?

The responsiveness is quick; I like the availability of help, the system's overall presence, its adaptability to evolving technology, and the aid given because of such changes.

What do you dislike about the product?

For some of us who aren't exactly tech-savvy, the system isn't exactly user-friendly; it needs a little more simplification and instant help, perhaps, to navigate the system properly.

What problems is the product solving and how is that benefiting you?

Trelix helps us be vigilant for the safety of our organisation's network, and we can avoid cyber-attacks and potentially safeguard our organisation's sensitive information.

What do you like best about the product?

I really like Trellix Network Detection and Response (NDR) for its real-time network visibility and the ability to quickly detect suspicious activities. It makes threat investigation easier by providing useful context and helps security teams respond to incidents more efficiently. The real-time visibility also helps me quickly identify unusual or potentially malicious activity, which reduces investigation time and provides better context during security incidents, allowing the team to respond to threats before they can have a larger impact.

What do you dislike about the product?

Overall, Trellix NDR works well, but the user experience could be improved. I would like to see a simpler interface, more customizable dashboards and reports, and easier integration with other security tools. Faster investigation workflows and more clear, actionable alerts would also make it more efficient for daily use. I would suggest making the interface more intuitive and customizable. It would be helpful to have flexible dashboard layouts, customizable alerts and notifications, better filtering and search options, and the ability to save user-specific views. Improving navigation and providing clearer visual indicators for important events would also make the platform easier and faster to use.

What problems is the product solving and how is that benefiting you?

I use Trellix Network Detection and Response (NDR) to enhance network visibility, quickly detect and respond to threats, solve limited visibility issues, and reduce false positives. It speeds up investigation and provides better context during incidents, ultimately preventing significant impact from threats.

What do you like best about the product?

I like the capability of Trellix Network Detection and Response (NDR) to provide good network visibility and quickly identify bad behaviors or potential threats. It allows me to have a clearer view of what's happening in the network environment, enabling the detection of communication patterns and abnormal behaviors, as well as verifying threats more quickly. This helps in having a quick and informed response.

What do you dislike about the product?

The interface could be simpler and more intuitive, especially to facilitate quick alert analysis and investigation. Improving alert prioritization and contextualization would reduce false positives and highlight more critical incidents more clearly. Additionally, better integration with other security tools and existing systems, along with more customized reports and dashboards, could facilitate the daily work of the team and improve decision-making.

What problems is the product solving and how is that benefiting you?

I use Trellix NDR to monitor and analyze network traffic, detect threats and suspicious activities in real-time, improving network visibility, which allows me a quick and informed response.

What do you like best about the product?

I like the dashboard showing IPS and malicious traffic detected, as it provides clear visibility. Additionally, I appreciate the multitude of detections possible. The initial setup of Trellix Network Detection and Response (NDR) was straightforward.

What do you dislike about the product?

I don't like that the IPS engines leave some critical events unblocked. This requires us to create our own rules to block these, which feels cumbersome. I believe that critical or high-marked events should be blocked by default, and we should receive alerts to review and open them if necessary, not the other way around.

What problems is the product solving and how is that benefiting you?

Trellix Network Detection and Response (NDR) gives me visibility into traffic entering hosts and checks EDR functionality, while also showing detected malicious traffic on the dashboard. It supports detecting a multitude of threats, though I need to set custom rules for some critical events left unblocked.

What do you like best about the product?

What I like most about Trellix NDR is the visibility it gives into network activity. It makes it easier to spot unusual traffic, suspicious connections, and behavior that may otherwise be difficult to notice through traditional monitoring alone.

I also find the investigation side useful. When an alert comes in, having the related network activity available in one place helps us understand what happened and whether it is actually something that needs attention. It is especially helpful as an additional layer of detection alongside other security tools.

What do you dislike about the product?

One thing I dislike is that the platform can feel a bit complex at first, especially when you are trying to understand why a particular alert was triggered. Some alerts need additional investigation and tuning before they become really useful, otherwise there can be unnecessary noise.

What problems is the product solving and how is that benefiting you?

Trellix NDR helps us identify suspicious network activity that may not always be visible through endpoint or firewall monitoring alone. It gives us better visibility into unusual connections, traffic patterns, and potential threats moving across the network.

The main benefit is that it helps reduce the time spent investigating security events. Instead of checking multiple sources separately, we can use the network data to understand what happened and decide whether an alert needs further action. It has also improved our overall monitoring and incident investigation process.

What do you like best about the product?

I appreciate the integration of Trellix Wise which ensures global visibility and risk prioritization. Additionally, the migration from McAfee to Trellix was completely smooth.

What do you dislike about the product?

Nothing to mention.

What problems is the product solving and how is that benefiting you?

Trellix NDR addresses issues of alert overload, analyst fatigue, blind spots in encrypted traffic, and improves visibility of unmanaged devices.