What is our primary use case?
My major use case for Symantec Protection Engine is the protection of our endpoints and servers. We have Red Hat Linux servers, Windows servers, and Windows desktops and laptops, and I protect all of them. We have Oracle Database, MySQL, and Postgres servers running on the RHEL platform, along with various websites. We used to protect the servers through the Symantec protection suite. We also protect desktops running various versions of Windows, such as Windows 10 and 11.
How has it helped my organization?
What stands out is that a ransomware attack has never happened in my environment since we adopted the solution. That is the biggest advantage, and it applies to ransomware and any other attacks. Previously, a couple of attacks happened in my environment. After procuring Symantec and renewing it, we have never faced any attack events.
What is most valuable?
The console is excellent for centralized control. Through it, I can push policies, update signatures, manage the entire network, and remove access. This is a fantastic feature, and I feel it is a great asset. Policies and endpoint firewalls can also be pushed, and endpoint exclusions for some applications can be whitelisted. These features are very nice for a system admin because they allow for better management. For example, if my Oracle is not patched, the Endpoint Protection Suite enables virtual patching. That is one of the biggest features and provides great value.
Content scanning is very important to me, and it helps with threat detection. Content scanning has a great advantage at the memory level and in real-time memory use cases. It has a product for content scanning and real-time memory, and it even detects DLL files and some rootkits. For instance, it is fantastic against Linux server rootkits. That is why I have not found any attacks recently. I use all of this for my production workloads, where the servers I mentioned handle more than 2 lakh to 3 lakh users and are protected with the Symantec protection suite.
I find it quite seamless to integrate Symantec Protection Engine with IT infrastructure. It is very easy to integrate, and there is no doubt about it. Integration is significant to me, and I see benefits in this capability. The integration I am referring to is with IT infrastructure and potentially with third-party applications. Since this protection suite is installed on the respective host machines, I add policies according to my use case. It supports various platforms, and in my environment, I have only Red Hat Linux, Windows, and Windows desktops. Therefore, I do not have any challenges integrating this protection suite.
Policy management is very important to me because I have different use cases with different servers and applications running on them. I create various profiles and manage workloads effectively with the help of policy management. It allows me to create different policies and push them to different categories or groups of workloads. I have Windows Active Directory workloads, DNS workloads, Apache workloads, and more. This capability is fantastic for managing my workloads.
Threat intelligence is effective for protecting against some threats. Since there are primarily no problems in my environment, I think it is perfectly fine.
What needs improvement?
High-performance scanning has an impact on my operational efficiency. I find this a little drawback in Symantec Protection Engine because it throttles a lot of CPU. It consumes a lot of resources when I perform content scanning. If I do a complete scan, whether on a server or through real-time scans, especially when dealing with huge files, it takes up a lot of CPU. Until the scan completes, this becomes a bottleneck. Otherwise, it is okay because protection-wise, there is no doubt. I do not find any major attacks in my environment.
I see room for enhancement in Symantec Protection Engine. I do not think they have a properly developed SIEM and SOAR product. I feel file integrity monitoring is a crucial feature, and Symantec does not provide this capability in the protection suite I am using. If anyone changes a file, there is no tracking of that, and I find this aspect quite important. Also, scanning uses a considerable amount of resources on desktops and servers, which leads me to schedule scanning only during non-peak hours. This becomes a real challenge because the production workload runs 24/7, which necessitates careful planning.
For how long have I used the solution?
I started working with Symantec Protection Engine quite some time ago, and we have been using it from 2008 or 2009 onwards. I used it personally until about one and a half years ago. It is still under use.
What do I think about the stability of the solution?
I find Symantec Protection Engine to be very good and stable, and I do not encounter any problems.
What do I think about the scalability of the solution?
In terms of scalability, I feel upgrading poses challenges. While my uses are defined, upgrading is not that easy. I have previously encountered challenges with the upgrade process, which necessitates that my team always submit support tickets. Adding more nodes onto the existing console presents no challenges.
How are customer service and support?
The technical support is generally good, but getting a ticket resolved can be tough. I find their direct call facility lacking, as I must call through their portal. This aspect could be improved.
If I had to rate support on a scale from zero to ten, I would give them a seven. I cannot give more than that.
How was the initial setup?
I find Symantec Protection Engine very easy to install and deploy. I have installed it even on my Red Hat Linux servers.
What was our ROI?
I think tracking ROI with Symantec is feasible. The best aspect for me is the time and money saved because my production workload has not been affected to this day. That represents a substantial return on investment.
What's my experience with pricing, setup cost, and licensing?
Regarding price, I think it is comparable to Trend Micro, so I find it quite equal. However, I also use Trend Micro Apex One for some workloads for a few users in my environment.
Which other solutions did I evaluate?
In terms of technical comparison between Trend Micro and Symantec, I find Trend Micro to have more advanced features. Trend Micro has additional features, such as file integrity monitoring, as part of its protection suite. I consider this very important for my workload, especially in a data center environment where multiple guest operating systems are running. I need this monitoring for file integrity on those servers. In terms of capabilities, I do not have experience with the Symantec Data Center edition, but I believe Trend Micro excels in this area.
Trend Micro also provides certain Web Application Protection capabilities to combat SQL injection and cross-site scripting attacks, though Symantec requires a separate product for full WAF capabilities. In comparing the IPS engines of both products, I found Trend Micro to be slightly better, enabling fine-tuning at the application layer, while Symantec lacks some of this capability. Overall, I would rate Trend Micro five stars and Symantec about 4.5 stars.
What other advice do I have?
For my final rating of Symantec Protection Engine, I would give it a nine overall, as the product itself deserves that rating. Support-wise, I can only give a seven.
Which deployment model are you using for this solution?
On-premises