Try our new research platform with insights from 80,000+ expert users

Microsoft Defender XDR vs SonicWall Capture Client comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Microsoft Defender XDR
Ranking in Endpoint Detection and Response (EDR)
5th
Average Rating
8.4
Reviews Sentiment
7.1
Number of Reviews
97
Ranking in other categories
Extended Detection and Response (XDR) (4th), Microsoft Security Suite (3rd)
SonicWall Capture Client
Ranking in Endpoint Detection and Response (EDR)
44th
Average Rating
8.0
Reviews Sentiment
7.5
Number of Reviews
9
Ranking in other categories
Endpoint Protection Platform (EPP) (47th)
 

Mindshare comparison

As of April 2025, in the Endpoint Detection and Response (EDR) category, the mindshare of Microsoft Defender XDR is 3.3%, up from 3.4% compared to the previous year. The mindshare of SonicWall Capture Client is 0.6%, down from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Endpoint Detection and Response (EDR)
 

Featured Reviews

Gabor Nyerd - PeerSpot reviewer
Includes four services and four products, which can help organizations a lot
We found that sometimes integrations work, but testing them can take some time. Sometimes, configurations take much longer than expected. We have a configuration in place that needs to be synchronized with another server. However, the servers are four hours apart, so this can cause delays. In general, I believe that the time it takes to configure and test a service should be shorter. Sometimes, it can take a couple of hours to test a single configuration setting. Other times, it is only ten or fifteen minutes, which is normal. However, sometimes, even immediate actions can be triggered by configuration changes, and some settings can take up to eight hours to complete. I believe that this time can be improved. Microsoft is making a lot of improvements to its services in a short period of time. This is a good thing, as it means that the services are constantly being updated and improved. However, it can be challenging for customers to keep up with the changes. For example, a customer may read about an update, understand it, and share it with their colleagues and boss. However, it may take days or weeks to test the update and get the necessary approvals. This can be especially challenging for large customers with many users or machines. In some cases, Microsoft may change a service before the customer has had a chance to implement the previous update. This can be frustrating for customers, as it means that they have to constantly learn new things and adjust their workflows. On the one hand, it is important for Microsoft to keep updating and improving its services. This helps to ensure that the services are meeting the customers' needs and that they are staying ahead of the competition. Microsoft should also be mindful of the challenges that these changes can create for customers. One way to address this challenge is to provide customers with more time to implement changes. Microsoft could also provide more information about upcoming changes so that customers can plan ahead. Ultimately, Microsoft needs to strike a balance between keeping its services up-to-date and providing customers with a smooth transition to new features.
LUIZ FERNANDO MARIANO SILVA - PeerSpot reviewer
Enables faster updates and provides an easy-to-use user interface
I have an advanced license that includes all features. Though we have the license, we cannot use it completely because it is not enabled in the Microsoft tier. It does not make sense. We do not want to buy it separately because the price is different if we buy separate licenses.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The timeline feature is excellent. I also like the phishing simulation. We have phishing campaigns to educate employees and warn them about these threats."
"The integration with other Microsoft solutions is the most valuable feature."
"For me, the advanced hunting capabilities have been really great. It allowed querying the dataset with their own language, which is KQL or Kusto Query Language. That has allowed me to get much more insight into the events that have occurred. The whole power of 365 Defender is that you can get the whole story. It allows you to query an email-based activity and then correlate it with an endpoint-based activity."
"Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and potential indicators of compromise."
"The most valuable feature is the network security."
"Defender XDR offers richer insights into Defender XDR. It's a better overall experience."
"Microsoft 365 Defender is a good solution and easy to use."
"The portal is quite user-friendly. There is integration with Office, Intune, and other products from the same portal. From there, we can see which policies are installed on a particular machine. We also can manage devices, groups, and tagging."
"The initial setup is straightforward."
"The product’s interface is easy to use."
"SonicWall Capture Client's scalability is nice."
"The solution serves as a very stable platform."
"SonicWall Capture Client has a serial number to connect to your firewall."
"The threat protection feature of SonicWall Capture Client is most valuable."
"The most valuable features of SonicWall Capture Client are CSC (Capture Security Center), RTDMI (Real-Time Deep Memory Inspection), and the deep memory inspection feature."
"SonicWall Capture Client offers a cost-effective solution that's cheaper compared to other vendors like CrowdStrike."
 

Cons

"The cost can be high if you want to build custom license packages. Another area for improvement is the policies. In Azure, we need to implement policies in JSON format, but in 365 Defender 365, it would be helpful to use a different format so we can customize the platform."
"When we do investigations, it would be better if Microsoft could populate the host dashboard more. When we open any host for investigation, we want the entire timeline of what is happening on the host, including all the users logging in, their hardware, Windows version, etc."
"Improving scalability, especially for very large tenants, could be beneficial for Microsoft Defender XDR."
"Defender also lacks automated detection and response. You need to resolve issues manually. You can manage multiple Microsoft security products from a single portal, and all your security recommendations are in one place. It's easy to understand and manage. However, I wouldn't say Defender is a single pane of glass. You still need to switch between all of the available Microsoft tools. You can see all the alerts in one panel, but you can't automate remediation."
"The support team is not competent or responsive."
"While the XDR platform offers valuable functionalities, it falls short of other solutions in its ability to deliver a cohesive identity experience."
"There is no comprehensive visibility, making it less user-friendly."
"It would be highly beneficial if CoPilot could identify anomalies within the network and notify the IT team."
"SonicWall Capture Client could be made a little lighter than it currently is in terms of memory consumption."
"The biggest issue with SonicWall Capture Client is network latency."
"An area for improvement in SonicWall Capture Client is TenantCloud support. Suppose you want to implement SonicWall Capture Client. You'll have to register it on MySonicWall. Then once your SonicWall Capture Client license expires and you don't want to renew it, you can't delete it from your MySonicWall account, so that's an area for improvement."
"They should improve their user interface."
"Technical support from SonicWall has room for improvement. While their escalation process is understandable, it can be time-consuming as all logs need to be provided multiple times across different service levels."
"The implementation is not easy."
"The vulnerability reports need to be better. Windows Defender detected some issues that SonicWall Capture Client couldn't."
"SonicWall Capture Client should use less of our PC's memory, as it tends to slow down the performance."
 

Pricing and Cost Advice

"365 Defender can get expensive because you pay per gigabyte of data ingested. On the other hand, much of the data available in the other Microsoft security solutions are made available relatively cheaply—sometimes at cost or for free. Integrating only a limited set of third-party solutions with Sentinel would be cost-effective. It's much more affordable if companies only have Microsoft stuff."
"I believe that the pricing of the licensing is fair."
"The solutions price is fair for what they offer."
"Microsoft Defender XDR's licensing is complicated."
"On average, we pay around 55 euros per user for the services and features we receive."
"Microsoft Defender XDR is included in our license."
"Microsoft Defender XDR is priced high."
"Microsoft is not competitive with the pricing of the solution. The competitors are able to offer lower discounts. The price of the solution is higher."
"You have to pay for the solution, and a lot of customers do not want to pay."
"The product is very expensive."
"Here in Indonesia, SonicWall Capture Client costs five hundred thousand rupiahs for every endpoint. If I'm correct, you only have to pay the licensing fee, and there's no additional fee. To me, the pricing for SonicWall Capture Client is four out of five."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
848,253 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
9%
Manufacturing Company
8%
Government
8%
Computer Software Company
13%
Government
9%
Educational Organization
9%
Real Estate/Law Firm
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and potential indicators of compromise.
What is your experience regarding pricing and costs for Microsoft 365 Defender?
Licensing is somewhat confusing, particularly when presenting our pitch decks to stakeholders and leveraging key features in premium SKUs, but we managed with some assistance from Microsoft.
What needs improvement with Microsoft 365 Defender?
It would be beneficial to reduce the number of clicks required to navigate between blades, as the current navigation and breadcrumb system can be a bit confusing. Some inconsistencies exist between...
What do you like most about SonicWall Capture Client?
SonicWall Capture Client's scalability is nice.
What is your experience regarding pricing and costs for SonicWall Capture Client?
SonicWall Capture Client offers a cost-effective solution that's cheaper compared to other vendors like CrowdStrike.
What needs improvement with SonicWall Capture Client?
SonicWall Capture Client could benefit from an improved graphical user interface with more modern and minimal icons. Additionally, one of the drawbacks is that I cannot use Advanced and Premier lic...
 

Also Known As

Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
No data available
 

Overview

 

Sample Customers

Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
Luton College
Find out what your peers are saying about Microsoft Defender XDR vs. SonicWall Capture Client and other solutions. Updated: March 2025.
848,253 professionals have used our research since 2012.