Bitdefender Sandbox Analyzer vs Microsoft Defender for Identity comparison

"It is easy to use, and there is a lot of automation. So, users don't need to worry about that."

"Sandbox Analyzer is easy to use. It's simple to drill down into the data. In a lot of the competing products, an extremely informed end-user can do battle with the tools provided, but in today's market, end-users have less and less time to try and keep up. The CSAW alerts come out every day, and they're huge. Adobe did a master patch last Thursday and another one a few days later."

"The solution is useful in the event of a gray file or grayware, as there are certain files users may download of which we know little about."

"I like the fact that it works pretty well. It can be a little aggressive at times, but I'd rather have it be a little bit aggressive than not catch what it's supposed to catch. We've been running that platform for about five years, and we've not really had any viruses or malware get through. It's also easy to set up, and it's easy to manage."

"All the integration it has with different Microsoft packages, like Teams and Office, is good."

"One of our users had the same password for every personal and company account. That was a problem because she started receiving phishing emails that could compromise all of her accounts. Defender told us that the user was not changing their password."

"The basic security monitoring at its core feature is the most valuable aspect. But also the investigative parts, the historical logging of events over the network are extremely interesting because it gives an in-depth insight into the history of account activity that is really easy to read, easy to follow, and easy to export."

"The most valuable aspect is its connection to Microsoft Sentinel and Defender for Endpoint, and giving exact timelines for incidents and when certain events occured during an incident."

"It automates routine testing and helps automate the finding of high-value alerts."

"It is easy to set up. Based on the number of devices you would like to set up, you can use scripts, Group Policy, etc. It takes five minutes to set up."

"This solution has advanced a lot over the last few years."

"The solution’s alerting is fairly efficient."

"It does everything we need. We haven't been able to throw anything at it that it couldn't handle."

"It would be better if there were real-time alerts. The whole suite, unlike most anti-virus consoles that just ping you when there's an infection or something, for some inexplicable reason, Bitdefender doesn't do that. The most you could do is get an hourly email, or maybe if there's an outbreak that affects 30% of our machines, it sends me an email. There's no real-time alert to say, "Hey, so-and-so literally 30 seconds ago just had this happen on their machine." Real-time reporting would be a huge improvement. All in all, it's a pretty nice product, generally speaking. They do a pretty good job. They can pretty much go toe to toe with just about anybody. But it's that kind of real-time nature. I've not had occasion to use the EDR portion to actually try and do any kind of custom scripting to drill into things that are going on at the endpoints. But my understanding from reading comments of others is that it's not particularly flexible in that regard to be able to do things like that."

"It should be more secure. There should be more protection, especially for non-signature-based malware. It works fine for non-signature-based malware, but I expect it to become a bit more advanced to be able to cope with future or upcoming environments."

"We propose the on-premises solution to most of our customers, for which we must provide a license, although no such request accompanies customers who want a cloud-based solution."

"We would like to see the time it takes for the sandbox to analyze a file reduced from its ten or fifteen minute duration to five."

"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."

"When the data leaves the cloud, there are security issues."

"The technical support needs significant improvement. Documentation for more minor issues in the form of guides or walkthroughs could help to resolve this issue. The number of tickets raised would decrease, removing some pressure from the support team and making it easier to clear the remaining tickets."

"The solution could be better at using group-managed access and they could replace it with broad-based access controls."

"There is no option to remedy an issue directly from the console. If we see an alert, we can't fix it from the console. Instead, we must depend on other Microsoft products, such as MDE. That is a significant drawback. It simply works as a scanner, which can sometimes put enough load on the sensors. Immediate actions should be possible from the dashboard because. It can prevent issues from spreading further."

"One potential area for improvement could be exploring flexibility in the installation of Microsoft Defender for Identity agents."

"Microsoft should look at what competing vendors like CrowdStrike and Broadcom are doing and incorporate those features into Sentinel and Defender. At the same time, I think the intelligence inside the product is improving fast. They should incorporate more zero-trust and hybrid trust approaches. They need to build up threat intelligence based on threats and methods used in attacks on other companies."

"An area for improvement is the administrative interface. It's basic compared to other administrative centers. They could make it more user-friendly and easier to navigate."

"I think it's probably less expensive than something like CrowdStrike. We got a really good deal because it was literally their year-end, and they were trying to close all the sales for the week. So we bought a three-year contract from them. It roughly ended up costing me somewhere around $17 for an endpoint per year. It was really quite a nice pricing. I've talked to other folks where they got CrowdStrike, and it's like $60 for an endpoint for a year. It does, and they can be pretty aggressive if you're dealing with them directly, and I have. So no complaints there."

"You need a license to a certain extent. You need to pay for advanced features. For corporate accounts, it isn't is really a problem, but pricing is an important thing for many companies."

"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."

"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."

"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."

"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."