Trellix Helix Connect Reviews

We use Helix in a very restrictive environment that doesn't allow solutions to be connected to the cloud. Some solutions, like CrowdStrike and some XDR solutions, need to be connected to an external cloud. The same goes for Trellix, but with Helix, we have one option. 

If we need DDI feeds or IOC feeds from vendors or customers, Helix will provide these IOCs via DDI push from Trellix to our side, even if we haven't faced any incidents.

It's very easy to integrate Helix into IT workflows in general, especially if you have the original system. If you have the full portfolio from Trellix or solutions that integrate easily, like XSOAR or some buckets of vendor flow or vendors like Kaspersky, then we won't be facing many problems. 

I have worked on implementations with Huawei and IBM QRadar. Now, when it's a Helix operation. Sometimes, I remember that IBM told me to open a request for enhancement from both sides, Huawei and IBM, which, until now, hasn't happened. These tickets have been open for about three years. That caused the customer to replace Huawei with a Cisco engine to make the integration very easy. 

I am aware that Helix is investing in the development to enhance its solutions. I already attended multiple webinars regarding cybersecurity solutions from Trellix's cybersecurity solutions. 

However, I’m not sure if it can integrate with other vendors like IBM’s EDR or cloud-based solutions. But as far as its core functionality goes, it’s spot-on.

It helps prevent web security threats and other things.

We use Trellix ePO. We also use Trellix Endpoint Security and DLP encryption.

We are currently integrated with fewer security devices. It helps us understand deductions and analysis and provides collaborative input as a first priority. 

You can use it for everything, incident response, automated responses, alerts,  visibility.

The most valuable features include predefined use cases and threatening states. If I'm investigating a threat, I can run a query, and it'll suggest the next query I'm supposed to write. And they're making a lot of enhancements.

We use Trellix Helix for protection against network attacks, TLS, and SSL attacks. We also use the solution for user behaviour accesses.

Trellix Helix helps prevent email attacks, like phishing and email spoofing attacks.

It is used for correlating data.

It is kind of simple and very easily deployable. You can start working with it very fast.

We have evaluated great vendors like QRadar, Splunk, and all the big players, but they are certainly lacking at getting all the investigations done properly. With FireEye Helix, if a customer already uses any of the FireEye endpoint solutions, the response part is very fast and the investigation is also very fast. You can do a lot of investigation depending on what that product's like. If you want to clarify something on the endpoint, you have to do it manually but if you are a FireEye customer, you can do it right away. The email security offering around FireEye also directly integrates with your Helix. So if you have to investigate malware you can do it from Helix. It's very powerful and centered on the cloud. 

The integration is very useful and very easy. You can have an API connection with any cloud and I am able to do both ways of communication with the help of the API.

The local center can help you to address the network. We place a logger on-premises to send the logs of other appliances to FireEye Helix. So that the same appliance can also be used as a network endpoint solution, doing dynamic analysis.

I primarily use FireEye Helix to manage alerts and tickets.

FireEye Helix's best features are its speed and use of an easy-to-understand language to send queries to the raw logs.