Kaspersky Endpoint Detection and Response Reviews

Our use cases include ISC's indicator for compromise, blocking, caching, and automation. For example, the detection of any USB or removable device on any system triggers a response. 

Additionally, if any malware is detected in the system, the EDR solution removes it. These are the primary use cases we focus on. 

Another scenario involves the detection of a large data transfer, such as 3GB via a USB device, to another system, which must be identified. These are the main use cases we prioritize.

One of the good features is the provider's Faulting capability. If any of our systems detect malware, we can check the behavior of the malware by sending it to Kaspersky's sandbox environment. 

This helps us assess how destructive the malware is. After analyzing it, we can create use cases and protection measures based on that behavior. So, this is the best feature of Kaspersky.

Kaspersky EDR is far superior to other products. It gives detailed information about malware, geolocation, and more. Also, the agent itself is very lightweight compared to other products. The packages and updates were quite small in size, just a few KBs. 

And the best part is that when you apply a policy or make any changes, it immediately works. Regardless of the device's location, as long as it's reachable to the server, the policy applies within fractions of seconds. I had hands-on experience with an on-premises server on my premises. Once I applied any policy or made changes, it was assessed immediately, even if the PC was in a different country. As long as my PC was reachable, everything worked fine.

Moreover, the reports Kaspersky EDR generates, like the weekly and monthly reports, were amazing. We fully customized the on-premises server according to our needs, including how to push Windows patches, application updates, and whitelisting. One of the things I really like about Kaspersky is that even as an administrator, it won't allow you to bypass the applied policies.

The main issue was compatibility with the cloud itself. The CPU usage immediately spiked, causing the machines to hang and sometimes even forcing server or computer restarts. Within seconds of installing the agent, the CPU usage would become extremely high, rendering the machine practically unusable until we either manually restarted it or initiated a forced restart. We were left with no option but to uninstall the client.

It was the primary issue. When the agent was installed from the cloud portal, the machine became completely unresponsive and disconnected from the network.

I was quite satisfied with Kaspersky products when they were on-premises. The server was downloading the updates and signatures smoothly, and it was fully stable in our network. However, we decided to move to the cloud as we were offered better options, and there was no significant pricing difference. But unfortunately, once we moved to the cloud and deployed the agents on our clients, our clients started facing disconnection issues. We had no choice but to forcefully restart the machines. We tried seeking help from Kaspersky, but we didn't receive any assistance, which led us to switch to another product.

My company uses the EDR functionalities of Kaspersky, which are not related to application security. Kaspersky Endpoint Detection and Response is useful for environment scanning and can be deployed on a server to scan for viruses, malware, and hardware. We also use the product for EDR integration with the SIEM solution and get logs from each device.

The most valuable feature of the solution is its centralization capability allowing everything to be done from one device, including deployment, and integrating with the domain controller to do further deployments.

I use the tool for endpoints. 

From my point of view, one of the best aspects of Kaspersky Endpoint Detection and Response is its high detection rate, which surpasses many other solutions. Its valuable features include behavior detection, threat prevention, device control, adaptive anomaly control, and centralized protection detection.

The solution is an antivirus.

The tool is easy to use. It provides good protection. The product doesn't affect the performance of the computers.

We use Kaspersky on around one to two thousand servers and around four hundred workstations. Today, I work with Kaspersky EDR, and we also use Microsoft 365 Business Premium licenses.

Before we implemented Kaspersky here, we had McAfee, so we had a big security improvement with the Kaspersky deployment. We have patch management with Kaspersky under the Windows Update Services.

Kaspersky Endpoint provides multiple features. For example, it offers encryption, protection against targeted attacks, behavior and ML analysis, and multiple policies are available in Kaspersky. We recommend Kaspersky the most in Pakistan. Its advanced EDR features provide additional capabilities in endpoint security, including complete visibility of the quarantine system.

Kaspersky EDR gives complete path visibility of file location. It's allowed to contain the file in the same place. It does not spread the file to other locations or another system.

I use Kaspersky Endpoint Detection and Response for mobile devices and laptops. I also run it on some of my servers in the data center.

The product's biggest features are reporting and signature-based malware detection. It runs on how the machines are used in a particular environment.