Siemplify vs VMware Carbon Black Endpoint comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Microsoft Sentinel
Sponsored
Average Rating
8.2
Number of Reviews
86
Ranking in other categories
Security Information and Event Management (SIEM) (2nd), Security Orchestration Automation and Response (SOAR) (1st), Microsoft Security Suite (5th)
Siemplify
Average Rating
8.6
Number of Reviews
3
Ranking in other categories
Security Orchestration Automation and Response (SOAR) (16th)
VMware Carbon Black Endpoint
Average Rating
7.8
Number of Reviews
63
Ranking in other categories
Endpoint Protection Platform (EPP) (17th), Security Incident Response (1st), Endpoint Detection and Response (EDR) (14th), Ransomware Protection (4th)
 

Featured Reviews

Sachin Paul - PeerSpot reviewer
Dec 11, 2023
Makes data integration very easy for our SOC
It enables data integration within our hybrid, multi-cloud environment, and it makes this data integration very easy for our security operations center. Sentinel has helped improve our visibility into user and network behavior. It helps in identifying risky users, creating a watch list for specific users and their activities, which is very important. It has also been saving us time. It's a complete cloud-based solution, so there is no time wasted on setting up servers, infrastructure, et cetera. It also reduces the work involved in event investigation because it puts together detection logic through detection rules. That helps in automating incident identification.
CR
Apr 26, 2023
Great for reporting and ticketing for SOC MxDR client environments and has a great, supportive community
There are so many incredible features in the Chronicle SOAR platform that it's difficult to narrow down the list, however, if I had to choose, I would say that the most valuable features are the playbook builder and the integrations. The playbook builder allows us to establish workflows for the various case types that our analysts encounter within the SOC. These can be as granular or as high level as they need to be depending upon our business objectives and alert priorities. In turn, the tremendous number of integrations in the marketplace and the IDE (to custom-develop new integrations) are what make the playbooks as powerful as they are. Together, the integrations and playbooks make it simple to integrate powerful new capabilities and workflows.
OF
May 31, 2024
Integrates easily with our existing security infrastructure, but the technical support services need improvement
The solution has significantly improved our organization by providing fast detection and protection management. It enables us to conduct various queries and manage vulnerabilities effectively, ensuring our systems are protected against known threats The platform's capability to protect endpoints,…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The AI capability is one of the main features of the solution because I believe that in the market, there are few solutions that are providing security solutions based on AI and machine learning."
"The in-built SOAR of Sentinel is valuable. Kusto Query Language is also valuable for the ease of writing queries and ease of getting insights from the logs. Schedule-based queries within Sentinel are also valuable. I found these three features most useful for my projects."
"The initial setup is very simple and straightforward."
"The most valuable features in my experience are the UEBA, LDAP, the threat scheduler, and integration with third-party straight perform like the MISP."
"Mainly, this is a cloud-native product. So, there are zero concerns about managing the whole infrastructure on-premises."
"The data connectors that Microsoft Sentinel provides are easy to integrate when we work with a Microsoft agent."
"We’ve got process improvement that's happened across multiple different fronts within the organization, within our IT organization based on this tool being in place."
"The machine learning and artificial intelligence on offer are great."
"Without hyperbole, I have never, in my entire career, encountered a vendor or a vendor community as awesome as Siemplify. Siemplify and the Siemplify Community quite literally made it possible for our SOC to increase almost five-fold in our number of clients and number of analysts and to go from a Monday to Friday 9-5 shop to a 24/7 shop all in the span of under a year and a half and all while continually adding capabilities and improving the services we offer to our clients."
"The most valuable feature of Siemplify is the playbooks that can be created."
"The playbooks feature in Siemplify is crucial for automation. We've utilized both standard and custom integrations with other security operation solutions, enhancing our flexibility. The user interface is generally straightforward, although recent changes may require some adjustment and Siemplify's integrations and capabilities offer potential support for various compliance requirements."
"Carbon Black Defense has a higher detection ratio because it's cloud-based and it also does a lookup to virus total."
"The EDR and reports were helpful in improving our organization."
"It has intelligent learning behind it and we have been very successful in preventing attacks."
"The solution has a library where we can have multiple threat intels onboarded. We just have to subscribe to a particular site intel and they'll provide us with all of the truncated details so that we can create IOCs and alerts on the basis of those IOCs."
"It is a stable solution...The initial setup of VMware Carbon Black Endpoint was easy."
"It uses machine learning and behavioral analytics for advanced threat detection and response."
"The initial setup was fairly easy."
"CB Defense is more powerful, and you can take more actions than others. Its security features and signatures are constantly updated, so it is more effective than other security solutions."
 

Cons

"Currently, the watchlist feature is being utilized, and although there have been improvements, it is still not fully optimized."
"Sentinel's reporting is complex and can be more user-friendly."
"Microsoft Defender has a built-in threat expert option that enables you to contact an expert. That feature isn't available in Sentinel because it's a huge product that integrates all the technologies. I would like Microsoft to add the threat expert option so we can contact them. There are a few other features, like threat assessment that the PG team is working on. I expect them to release this feature in the next quarter."
"They could use some kind of workbook. There is some limitation doing the editing and creating the workbook."
"We'd like to see more connectors."
"I believe one of the challenges I encountered was the absence of live training sessions, even with the option to pay for them."
"Sentinel can be used in two ways. With other tools like QRadar, I don't need to run queries. Using Sentinel requires users to learn KQL to run technical queries and check things. If they don't know KQL, they can't fully utilize the solution."
"Its documentation is not so simple. It is easy for somebody who is Microsoft certified or more closely attached to Microsoft solutions. It is not easy for those who are working on open-source platforms. There isn't a central point where everything is documented, and there is no specific training or certification."
"We often encounter minor issues that could be improved, but we maintain communication with the developers and submit feature requests. Recently, I requested enhancements such as improved search functionality within playbooks and expanded options for exporting case data."
"I'm inclined to say that I'd love to see some Machine Learning capabilities integrated into the platform, however, I just attended a demo this morning where Siemplify gave a sneak peek into some Machine Learning capabilities that they are currently developing and have roadmapped for release soon."
"Building the playbooks could be easier and the integration could improve. It is a difficult process, such as what API connections need to be made."
"There are many different controls that are needed to be put into place for upgrading that makes it difficult. Having to re-engineer your IT infrastructure to match their software, as opposed to having it integrate and work independently causes difficulties. When there is an update to any software everyone has to be involved."
"There could be more knowledge. I think they made a mistake when they took away the Check Point integration, because it provides more automation and also more threat intelligence."
"Carbon Black has limited capability to integrate with Rapid7."
"Occasionally, we'll have issues with the latest version and they'll basically tell us that they will improve it in the next iteration. They need to work on their version release quality."
"The EDR portion could be better. I'm not a big fan, but it works."
"The local technical support is very poor, but the support from headquarters is very nice."
"The directions for Splunk are spot on, but it is difficult to find anything on integration with AlienVault,"
"The endpoint machines need improvement."
 

Pricing and Cost Advice

"Sentinel's pricing is on the higher side, but you can get a discount if you can predict your usage. You have to pay ingestion and storage fees. There are also fees for Logic Apps and particular features. It seems heavily focused on microtransactions, but they may be slightly optional. By contrast, Splunk requires no additional fee for their equivalent of Logic. You have a little more flexibility, but Sentinel's costs add up."
"In comparison to other security solutions, Microsoft Sentinel offers a reasonable price for the features included."
"The cost of Sentinel is high. It typically costs more than $100 for five to ten users of the licenses or subscriptions. It costs around $123 per day on the cloud. Small- to mid-sized organizations would need a dedicated budget to adopt this solution; however, the cost may not be an issue for large, enterprise-level organizations."
"It's costly to maintain and renew."
"Sentinel's price is comparable to pretty much everything out there. None of it is cheap, but we didn't think we could save money by going a different route. Sentinel was part of our Azure expenditures, so it was easier to add the expense instead of having a completely separate vendor."
"For us, it is not expensive at this time, but if we start to collect all logs from our on-premise SIEM solutions, it will cost more than QRadar. If we calculate its cost over the next five or ten years, it will cost more than what we paid for QRadar."
"Microsoft Sentinel is included in our E5 license."
"Microsoft is costlier. Some organizations may not be able to afford the cost of Sentinel orchestration and the Log Analytics workspace. The transaction hosting cost is also a little bit on the high side, compared to AWS and GCP."
Information not available
"Overall, it was cost-effective too."
"The cost is a considerable factor, but the benefit factor is the most important. When you compare it with other products, the price is high. Carbon Black will negotiate the price."
"The platform is expensive."
"The pricing is annually based and operates through another department than mine."
"The license is annual. It's a standard license."
"VMware Carbon Black Endpoint is an expensive product."
"Carbon Black provides competitive pricing."
"The product’s price is less expensive than other vendors."
report
Use our free recommendation engine to learn which Security Orchestration Automation and Response (SOAR) solutions are best for your needs.
787,779 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Financial Services Firm
10%
Government
9%
Manufacturing Company
7%
Computer Software Company
14%
Financial Services Firm
11%
Comms Service Provider
8%
Energy/Utilities Company
6%
Computer Software Company
15%
Financial Services Firm
10%
Government
9%
Manufacturing Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?
Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel an...
What is a better choice, Splunk or Azure Sentinel?
It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingest...
Which is better - Azure Sentinel or AWS Security Hub?
We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel...
What do you like most about Siemplify?
The playbooks feature in Siemplify is crucial for automation. We've utilized both standard and custom integrations wi...
What needs improvement with Siemplify?
We often encounter minor issues that could be improved, but we maintain communication with the developers and submit ...
What is your primary use case for Siemplify?
Siemplify has streamlined various tasks such as configuring playbooks, integrations, and running reports. It helps au...
What to choose: an endpoint antivirus, an EDR solution or both?
I can recommend Carbon Black, an award-winning next-gen anti-virus (NGAV) and endpoint detection and response (EDR) s...
What's the difference between Carbon Black CB Response and Carbon Black CB Defense?
Carbon Black offers two different levels of Endpoint Detection and Response. One is the VM Carbon Black Cloud Endpoin...
What do you like most about Carbon Black CB Defense?
VMware Carbon Black Endpoint is a highly stable solution.
 

Also Known As

Azure Sentinel
Siemplify ThreatNexus
Carbon Black CB Defense, Bit9, Confer
 

Overview

 

Sample Customers

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.
FedEx Mondelez Intenrational Check Point Trustwave Atos Cyberint Bae Systems Crowe Longwall Security Telefonica Nordea HCL
Netflix, Progress Residential, Indeed, Hologic, Gentle Giant, Samsung Research America
Find out what your peers are saying about Microsoft, Palo Alto Networks, Splunk and others in Security Orchestration Automation and Response (SOAR). Updated: June 2024.
787,779 professionals have used our research since 2012.