Trellix Endpoint Detection and Response (EDR) Reviews

I use César for our endpoints, our users, and the services from email and web services, back and forth, and also at the edge of our network. We have contracted firewalls and everything else for networking.

The product and the services we have are quite good. However, I cannot stay at this level forever. I have to improve continuously and dynamically. 

Everything is working, and the company is training its personnel. I have had in a few months in the past some attacks on personnel—so phishing, for example. I have spent efforts on training our managers and others - what can software do if the knowledge base is low?

Trellix Endpoint Detection and Response (EDR) is a very advanced solution, and it can work very well since it helps a user get very deep and very detailed information. With Trellix Endpoint Detection and Response (EDR), I can collect everything from the client without any problem. Trellix EDR API rate is very high, and they cover a very large number of attacks and IOCs because it stands as a highly corrected product with the help of a very high-level research and development team.

The most valuable features of the solution stem from the fact that the response and coverage that the tool provides are very high. The functionality of the product in terms of recovery and IOCs is very nice. The details included in the IOCs are something you can refer to with the help of the product's knowledge base, meaning you can get a reference about attacks and IOCs from certain databases of the tool, and it also covers the new attacks.

We use McAfee MVISION Endpoint Detection and Response for our endpoints, and we are currently trying out the solid core. The tool scans even memory sticks and shows you what's going on with your network.

What we're using the most and what we found valuable in McAfee MVISION Endpoint Detection and Response are Web Control, Advanced Threat Protection, and Threat Prevention features.

We use the tool for threat hunting. It detects a lot of threats daily.

We do not need to monitor the network all the time because the solution is completely automated. The administrators’ time can be dedicated to improving other projects.

It has been helpful in terms of identifying unknown threats. The file is available on the endpoint, and the information is retrieved to identify any unknown or malicious file and then converted to a known file.

The endpoints and utilization are too high, which impacts the production activity. 

There are no additional features I would add. The McAfee MVISION Endpoint Detection and Response already has multiple features required for an IT solution.

In my company, we use Trellix Endpoint Detection and Response (EDR) since it is a very helpful product. In my company, we install Trellix Endpoint Detection and Response (EDR) for all our machines and endpoints, along with Trellix Cloud Security. Trellix EDR can be integrated with Trellix SIEM. Trellix and McAfee Endpoint Security are used in our company as they offer endpoint protection.

Trellix Endpoint Detection and Response (EDR) offers endpoint protection and helps collect information while also allowing users to investigate malicious files in an IT environment.

Trellix purchased McAfee two years ago. At this moment, it may seem a bit difficult if I explain Trellix and McAfee separately. Trellix Endpoint Detection and Response (EDR) and McAfee MVISION Endpoint provide endpoint protection. In the future, if Trellix can compile both the products, Trellix Endpoint Detection and Response (EDR) and McAfee MVISION Endpoint, into one solution, our company need not install multiple agents, which can reduce the workload for IT and make the tool easy to manage.

The solution's downside stems from the fact that Trellix Endpoint Detection and Response (EDR) and McAfee MVISION Endpoint are not combined into a single solution, so from an improvement perspective, they need to be combined into a single solution. If both tools are combined into a single solution, it will become easier for a user to manage and deploy such a product.

It relies on external systems for detection and then asks the endpoint to handle blocking. However, the most crucial feature is its investigative capabilities. With real-time search and other functionalities, it enables comprehensive detection and response. This capability resembles a layered approach, integrating and correlating all relevant data for thorough investigation.

Trellix needs to focus on gaining traction with partners and building trust among users. Many users may have moved on due to the name change, but concerns about resource intensity are more related to endpoint security than EDR itself. Improving its position in Gartner's quadrant and enhancing the product's image are crucial.

I've used Trellix EDR to improve endpoints and servers' security and feed into MDR solutions.

The most useful features are behavior monitoring, DLP, and access control. The automation has gotten much better in the last two years than when it was McAfee. It works better now and integrates more smoothly.