Arista NDR Reviews

Name: Arista NDR
Brand: Arista
Rating: 5 (14 reviews)

4.5 out of 5

14 reviews
100% willing to recommend

197 followers

What is Arista NDR?UNIXBusinessApplication
Price:

Arista NDR (formerly Awake Security) is the only advanced network detection and response company that delivers answers, not alerts. By combining artificial intelligence with human expertise, Arista NDR hunts for both insider and external attacker behaviors, while providing autonomous triage and response with full forensics across traditional, IoT, and cloud networks. Arista NDR delivers continuous diagnostics for the entire enterprise threat landscape, processes countless network data points, senses abnormalities or threats, and reacts if necessary—all in a matter of seconds. The Arista NDP platform stands out from traditional security because it is designed to mimic the human brain. It recognizes malicious intent and learns over time, giving defenders greater visibility and insight into what threats exist and how to respond to them.

Get the Arista NDR Buyer's Guide and find out what your peers are saying about Arista NDR, Darktrace, Vectra AI and more!

Arista NDR is the #8 ranked solution in Network Traffic Analysis tools and top Network Detection and Response (NDR) solutions. PeerSpot users give Arista NDR an average rating of 9.0 out of 10. Arista NDR is most commonly compared to Darktrace: Arista NDR vs Darktrace. Arista NDR is popular among the large enterprise segment, accounting for 64% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 15% of all views.

Helped 767,319 peers since 2012

Featured reviews

reviewer1506834

Head of Information Security at a engineering company with 10,001+ employees

Feb 10, 2021

One concern I do have with Awake is that, ideally, it should be able identify high-risk users and devices and entities. However, we don't have confidence in their entity resolution, and we've provided this feedback to Awake. My understanding is that this is where some of the AI/ML is, and it hasn't been reliable in correctly identifying which device an activity is associated with. We have also encountered issues where it has merged two devices into one entity profile when they shouldn't be merged. The entity resolution is the weakest point of Awake so far. Even without that it's useful because with the MNDR team, they'll at least do some of that work for us and then we can follow up on certain things. But that is something that we would want to see improved. Because we have the MNDR team, in some ways we don't work as hands-on with the interface itself as we did before. But another thing that would be helpful would be easier ways to integrate it with other systems. The integrations seem to exist, but they're a little weak in terms of how easy they are to set up, or what kind of information can be pulled in. That's something they've said that they're working on, as part of their roadmap, but that is something that I would like to see improved.

Read full review

reviewer1719513

Chief Technology Officer at a financial services firm with 11-50 employees

Nov 18, 2021

We take in IOCs from my SOC and from AlienVault, and then we focus on traffic that hits IOCs and alerts us to it. The one thing that the Awake platform lacks is the ability to automate the ingestion of IOCs rather than having to import CSV files or JSON files manually. Awake didn't support the manual importation of CSV and JSON in version 3.0, but they added it in version 4.0. It's helpful, but it still has to be a specific CSV format. Automated IOCs are on the roadmap. Hopefully, they will be able to automate the ingestion of IOCs by Q1 next year. I'm currently leveraging Mind Meld, an open-source tool by Palo Alto, to ingest IOCs from external parties. I aggregate those lists and spit them out as a massive list of domains, hashes, file names, IPS. Then we aggregate those into their own specific categories, like a URL category. Awake ingests that just like the Palo Alto firewall does, and then it alerts me if traffic attempts to go into it. Some of that is already on the Palo Alto firewall, which blocks it, but that doesn't mean that there is no attempted communication. I want to know if there's a communication attempt because there might be an indicator on that specific device trying to reach an IOC. Yes, my Palo Alto blocked it, but there's still something odd sitting there, and what if it can reach a different IOC that I don't have information about? I want to focus on it. I could do that by leveraging Awake if it could ingest the IOCs automatically. That's something I leverage Awake for today. I still have to manually import it, which is cumbersome because I have to manipulate the files that I get from the different IOC providers into a specific format that it understands. Once they add the ability to automate that, it'll be more useful.

Read full review

David Saville

Senior Systems Engineer at WealthCounsel, LLC

Oct 5, 2021

One thing I would like to see is a little bit more education or experience on AWS cloud for their managed services team. We've explained how we have the information set up, that the traffic coming in goes to the AWS load balancer and then gets sent on to our internal servers. Because we are grabbing traffic behind that load balancer, it shows the source IP of all traffic coming from the load balancer. In reality, you need to look at the exported, four-header IP to see where it's actually coming from. I've explained that to them several times, but when I get notices they always tell me this traffic is coming from the IPs belonging to the load balancers, not the source IPs. So a little bit more education for their team about how AWS manages the traffic might help out. They might also be able to improve on the cloud side. Right now we're in the process of migrating all of our on-prem stuff to just the AWS cloud. We'll be utilizing this service as AWS-only. They said that we can set it up that way, but without the hardware appliance, I'm curious to see how that goes. It seemed to me, when we were setting up, that the AWS portion was still in its infancy, and still being tested or developed. It works great, but it did take a bit of work to get set up, so I'm curious to see how having the entire solution in the AWS cloud works. I'm hoping it works well when we do that migration in the next month or two.

Read full review

Arista NDR market share

Product category:

As of March 2024, the market share of Arista NDR in the Network Traffic Analysis (NTA) category stands at 5.2%, marking an increase of 1.2% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Network Traffic Analysis (NTA)

Key learnings from peers

Last updated Feb 25, 2024

Valuable Features

"Arista NDR's scalability is very good, making it easy to add more hardware components. You can order additional hardware and integrate it by stacking it with the existing setup. This feature cannot be seen in other NDR tools."
"When I create a workbench query in Awake to do threat hunting, it's much easier to query. You get a dictionary popup immediately when you try to type a new query. It says, "You want to search for a device?" Then you type in "D-E," and it gives you a list of commands, like device, data set behavior, etc. That gives you the ability to build your own query."
"The interface itself is clean and easy to use, yet customizable. I like that I can create my own dashboards fairly easily so that I can see what is important to me. Also, the query language is pretty easy to use. I haven't needed to use it a ton, but as I need to go in and do different queries based on their requests, it has been fairly simple to use."

Room for Improvement

"Arista NDR needs to open legal offices to be closer to customers and partners. It needs more visibility in the NDR market in the Middle East. While they are doing well, they lack sufficient engineers. They need to hire more engineers to meet the demand and expand their presence. The current team is good but not enough to fully capture the market."
"The one thing that the Awake platform lacks is the ability to automate the ingestion of IOCs rather than having to import CSV files or JSON files manually."
"One thing I would like to see is a little bit more education or experience on AWS cloud for their managed services team. We've explained how we have the information set up, that the traffic coming in goes to the AWS load balancer and then gets sent on to our internal servers... but when I get notices they always tell me this traffic is coming from the IPs belonging to the load balancers, not the source IPs. So a little bit more education for their team about how AWS manages the traffic might help out."

Pricing

"Because I represent a hedge fund, I have some leverage. I told them that they had to meet my conditions if they wanted me as a client. It was the same way with Awake. They wanted an initial four-year agreement. Initially, we signed on for a one-year contract, but they wanted the four-year deal when it came time for the renewal. I told them that I was not doing that. I said that they either had to do it on my terms, or I'd go somewhere else."
"Awake's pricing was very competitive. It's not a cheap option though. It's an investment to utilize it, but it's one that we decided was worth the cost, with the managed services. At our scale, it was a much better option to utilize their software and their managed services to handle this, rather than hiring another person to be an analyst. It was quite cost-effective for us."
"The pricing seems pretty reasonable for what we get out of it. We also found it to be more competitive than some other vendors that we've looked at."

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Arista NDR Buyer's Guide for additional reliable information.