NetWitness NDR and Trellix Active Response are two competing products in the network detection and response market. While NetWitness NDR is praised for its robust analytics, Trellix Active Response stands out for its comprehensive automated response capabilities, making it a preferred choice for users prioritizing rapid threat mitigation.
Features: NetWitness NDR is valued for its advanced threat detection through deep packet inspection, enriched metadata analytics, and robust forensic capabilities. Trellix Active Response is highly regarded for its automated incident response capabilities, extensive integration with other security tools, and customizable response workflows.
Room for Improvement: Users point out that NetWitness NDR could improve by simplifying its configuration processes, enhancing its integration with third-party tools, and speeding up its incident response time. Trellix Active Response users suggest improvements in the product’s scalability, more frequent updates to its threat intelligence database, and a better user interface.
Ease of Deployment and Customer Service: NetWitness NDR is described as having a fairly complex deployment process but receives positive feedback for its customer service. Trellix Active Response offers a more streamlined deployment but has mixed reviews concerning customer support responsiveness.
Pricing and ROI: NetWitness NDR carries a higher initial setup cost but delivers a strong ROI due to its advanced analytics. Trellix Active Response users find the pricing competitive and appreciate the cost-effectiveness brought by its automation features.
While we haven't yet quantified the financial benefits, we recognize that there has been a return on investment, particularly with operational efficiencies provided by the alerts.
The scalability of Active Response is satisfactory.
We would like Trellix to optimize the technology for these systems similarly to how it is deployed for normal endpoints.
They notify us immediately of any vulnerabilities on the endpoints, allowing us to deploy a response quickly.
Using a centralized combination of network and endpoint analysis, behavioral analysis, data science techniques and threat intelligence, NetWitness NDR helps analysts detect and resolve known and unknown attacks while automating and orchestrating the incident response lifecycle. With these capabilities on one platform, security teams can collapse disparate tools and data into a powerful, blazingly fast user interface.
Continuous Visibility into Your Endpoints:
Capture and monitor events, files, host flows, process objects, context, and system state changes that may be indicators of attack or dormant attack components.
Identify and Remediate Breaches Faster:
Access tools you need to quickly correct security issues. Send intelligence to analytics, operations, and forensic teams.
Target Critical Threats:
Get preconfigured and customizable actions when triggered, so you can target and eliminate threats.
We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.