NetWitness XDR vs Trellix Endpoint Detection and Response (EDR) comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Fortinet FortiEDR
Sponsored
Ranking in Endpoint Detection and Response (EDR)
12th
Average Rating
7.8
Number of Reviews
32
Ranking in other categories
No ranking in other categories
NetWitness XDR
Ranking in Endpoint Detection and Response (EDR)
37th
Average Rating
8.0
Number of Reviews
15
Ranking in other categories
Endpoint Protection Platform (EPP) (42nd), Threat Intelligence Platforms (13th), Security Orchestration Automation and Response (SOAR) (15th), Network Detection and Response (NDR) (9th), Extended Detection and Response (XDR) (17th)
Trellix Endpoint Detection ...
Ranking in Endpoint Detection and Response (EDR)
23rd
Average Rating
7.4
Number of Reviews
18
Ranking in other categories
No ranking in other categories
 

Market share comparison

As of June 2024, in the Endpoint Detection and Response (EDR) category, the market share of Fortinet FortiEDR is 7.4% and it increased by 62.0% compared to the previous year. The market share of NetWitness XDR is 0.2% and it decreased by 59.6% compared to the previous year. The market share of Trellix Endpoint Detection and Response (EDR) is 0.9% and it increased by 21.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR)
Unique Categories:
No other categories found
Endpoint Protection Platform (EPP)
0.2%
Threat Intelligence Platforms
0.3%
No other categories found
 

Featured Reviews

SP
May 1, 2023
We saw time to value within two weeks of implementing the solution, which strengthened our use cases
We use FortiAI, FortiSIEM, and FortiEDR Fortinet helped us scale large-scale deals with clients because of its strong offerings. Fortinet is very straightforward to use. I have access to a lot of technical resources, and I have been able to use them effectively. Fortinet has helped free up around…
HS
Aug 11, 2022
Advanced threat detection undermined by issues with blocking
I primarily use NetWitness Endpoint to detect anomalies like the presence of web shields that are not detected by traditional antivirus solutions. I also use it for digital forensics and containment NetWitness Endpoint has enabled us to detect attacks that bypass the first stage of cybersecurity,…
Juan Muriel - PeerSpot reviewer
Feb 22, 2024
Completely automated, affordable, and provides good technical functionalities
We use the tool for threat hunting. It detects a lot of threats daily We do not need to monitor the network all the time because the solution is completely automated. The administrators’ time can be dedicated to improving other projects. The antivirus and DLP features are valuable. Now, we have…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It notifies us if there's any suspicious file on any PC. If any execution or similar kind of thing is happening, it just alerts us. It doesn't only alert. It also blocks the execution until we allow it. We check whether the execution is legitimate or not, and then approve it or keep it blocked. This gives us a little bit of control over this mechanism. Fortinet FortiEDR is also very straightforward and easy to maintain."
"The product detects and blocks threats and is more proactive than firewalls."
"Exceptions are easy to create and the interface is easy to follow with a nice appearance."
"It is very easy to set up. I would rate my experience with the initial setup a ten out of ten, with ten being very easy to set up."
"Additionally, when it comes to EDR, there are more tools available to assist with client work."
"Impressive detection capabilities"
"Fortinet is very user-friendly for customers."
"Fortinet FortiEDR made our clients feel secure and more at ease, knowing that they had an EDR solution that would close the gap in their security posture."
"This solution allows us to locate the malware in real-time."
"It is stable. We have been using it for some time, without any issues."
"It's a scalable solution. We have around five to eight customers using RSA NetWitness Endpoint, and we hope to increase the number of users."
"The stability of the RSA NetWitness Endpoint is very good."
"The log correlation is good."
"The most valuable feature of RSA NetWitness Network is the single unified dashboard from which you can manage all the different products of RSA. Additionally, the integration with native applications is good."
"The interface of this solution is very flexible and easy to use."
"NetWitness Endpoint's most valuable features are its interoperability across many different operating systems and the ease of pivoting from network to endpoint via a single console."
"The biggest strength of the solution is that it's an integrated product that includes EDR and antivirus."
"It is a stable solution. Stability-wise, I rate the solution a nine out of ten...I rate the solution's technical support team a nine and a half or ten out of ten."
"The product is user-friendly."
"The investigation and rule detection feature of the solution has proven most useful for our company"
"The most valuable feature I found in McAfee MVISION Endpoint Detection and Response is the guided analytics or guided EDR investigation."
"When Trellix detects some threats, the device is isolated in a quarantine zone for examination."
"This is a stable product."
"Trellix Endpoint Detection and Response (EDR) offers endpoint protection and helps collect information while also allowing users to investigate malicious files in an IT environment...It is a stable solution...It is a scalable solution."
 

Cons

"FortiEDR could add a separate scanning dashboard. In incident management, we prefer to remove the endpoint system from the environment and scan the system. We typically use Symantec for that, but if we want to use FortiEDR for that, then we need a scanning tab to clarify things."
"The solution is not stable."
"We've had a lot of false positives; things incorrectly flagged that require manual configuration to allow. Even worse, after we allow a legitimate program, it sometimes gets flagged again after an update. This has caused a lot of extra work for my team."
"To improve Fortinet, we need to see more features and technology areas at the endpoint level introduced."
"The EDR console should have more extensive reporting. You shouldn't need to purchase FortiAnalyzer. It should be included in the EDR part. The security adviser cloud platform could be improved with more options for exclusive or intensive rules for devices."
"The dashboard isn't easy to access and manage."
"Detections could be improved."
"I think cloud security and SASE are areas of concern in the product where improvements are required. The tool's cloud version has to be improved in terms of the security it offers."
"The initial setup requires a high level of skill."
"The threat intelligence could improve in RSA NetWitness Endpoint."
"I would like to see Security Orchestration and Response Automation (SOAR) integration."
"When analyzing something, you have to click several times. It requires a lot of effort to find something."
"The deployment process is complex. I don't know why, but this solution will suddenly stop working. Logs stop coming. Often, one thing or another stops working. Most of the time, one of my team members is working with troubleshooting and working with technical support. Log passing is also one of the biggest challenge."
"The solution lacks a reporting engine."
"This solution needs an upgrade in reporting. I have heard from RSA that they are working on this, but as of yet it is not available."
"Threat detection could be better."
"The console has a lot of bugs, and it creates many issues."
"The graphical view for nodes must be increased."
"The dashboard and reporting features are not so user-friendly or intuitive, so they need some work."
"The searching capabilities for the IOCs can be further improved"
"One of the issues about the product stems from the failure to work on its administrative scalability. The aforementioned area can be considered for improvement."
"The endpoints and utilization are too high, which impacts the production activity."
"The technical support must be improved."
"The alert feature of McAfee MVISION Endpoint Detection and Response needs improvement because for you to get the alerts, you have to log on to the portal. What my company needs is a tool that sends you alerts. For example, if it detects a threat on your machine, it should send you an alert. My company gets the alerts instead from the antivirus software rather than the EDR. If you want to see the alerts on McAfee MVISION Endpoint Detection and Response, you have to connect to the system manually. Another area for improvement in the tool is the reporting. My company needs weekly and monthly reports about the alerts, but you can't extract reports from McAfee MVISION Endpoint Detection and Response, so a decision was made to move to another EDR solution, particularly Microsoft Defender for Endpoint, next month. My company tested Microsoft Defender for Endpoint via a POC for one to three months. The resource usage of McAfee MVISION Endpoint Detection and Response is also an area for improvement because it consumes a lot of memory. For example, during the on-demand scan, you can't work because of the high CPU usage. You need to schedule the scans. McAfee MVISION Endpoint Detection and Response has a lot of modules, but my company doesn't use all modules."
 

Pricing and Cost Advice

"The pricing is typical for enterprises and fairly priced."
"Fortinet FortiEDR has a yearly subscription."
"It's not cheap, but it's not expensive either."
"Offered at a high price"
"While the cost may have been high, we view it as a worthwhile investment due to Fortinet's reliability and long-term performance."
"We got a good deal on licensing, so it is in the competitive range."
"I would rate the solution's pricing an eight out of ten."
"The price is comprable to other endpoint security solutions."
"The price of the solution depends on the environment. If the environment is large then it will cost more. However, the larger the environment with more endpoints, you will receive an increased discount. If the environment is very small, then you might think it is expensive. It is always better to buy in bulk to receive a discount. The minimum number of assets is usually 500, with discounts on 1000 and 2000."
"NetWitness Endpoint is less costly than its competitors, but it offers fewer features."
"I do not have any opinion on the pricing or licensing of the product."
"We are on a three-year contract to use RSA NetWitness Network."
"It is an expensive product."
"They can easily adjust if you have the requirements which are required. If you have a budget cut or a budget constraint, they can bend."
"It is highly scalable. It can be bought based on your requirements."
"The pricing is not very economical. It is a quite costly product for India. One thing is that when you purchase it, you have to purchase a module separately."
"Speaking about the price, you must use the product to find the product's cost for you."
"The product’s pricing is reasonable."
"McAfee MVISION Endpoint Detection and Response is reasonable in terms of cost. It's a tool my company has been using for a few years now. It costs $25,000 to $30,000 for six hundred users."
"The cost is okay, compared to other products."
"On a scale of one to ten, where one is low and ten is high, I rate the solution's pricing an eight out of ten."
"Pricing for McAfee MVISION Endpoint Detection and Response is not that expensive, but it's not something that a startup could buy. Pricing for it is for midsized businesses. There's an additional payment if you want data retention for more than thirty days. They gave us data retention for thirty days. Then if you want longer data retention, they have the paid option for a three-month data retention period and for a one-year data retention period."
"The price is reasonable."
"The licensing costs attached to the solution are very easy to manage. There is a need to make yearly payments towards the licensing costs."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
787,061 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Government
8%
Manufacturing Company
8%
Financial Services Firm
8%
Financial Services Firm
15%
Computer Software Company
15%
Government
9%
Manufacturing Company
7%
Computer Software Company
17%
Financial Services Firm
11%
Manufacturing Company
11%
Government
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What's the difference between Fortinet's FortiEDR and FortiClient?
I suggest Fortinet’s FortiEDR over FortiClient for several reasons. For starters, FortiEDR guarantees solid protectio...
What do you like most about Fortinet FortiEDR?
We have FortiEDR installed on all our systems. This protects them from any threats.
What is your experience regarding pricing and costs for Fortinet FortiEDR?
We license it per employee, so as long as the employee count remains the same, the licensing won't change. We have it...
What is your experience regarding pricing and costs for NetWitness XDR?
The solution is expensive. I'd rate it at a one or two out of five. They need to adjust it to keep up with the compet...
What needs improvement with NetWitness XDR?
I have no real complaints about the solution. Threat detection could be better. They need to enhance their threat int...
 

Also Known As

enSilo, FortiEDR
RSA ECAT, NetWitness Network
McAfee MVISION EDR, MVISION EDR, MVISION Endpoint Detection and Response
 

Learn More

Video not available
 

Overview

 

Sample Customers

Financial, Healthcare, Legal, Technology, Enterprise, Manufacturing ... 
ADP, Ameritas, Partners Healthcare
Sutherland Global Services
Find out what your peers are saying about NetWitness XDR vs. Trellix Endpoint Detection and Response (EDR) and other solutions. Updated: May 2024.
787,061 professionals have used our research since 2012.