Arista NDR Reviews

Name: Arista NDR
Brand: Arista
Rating: 5 (14 reviews)

4.5 out of 5

14 reviews
100% willing to recommend

198 followers

What is Arista NDR?

Arista NDR (formerly Awake Security) is the only advanced network detection and response company that delivers answers, not alerts. By combining artificial intelligence with human expertise, Arista NDR hunts for both insider and external attacker behaviors, while providing autonomous triage and response with full forensics across traditional, IoT, and cloud networks. Arista NDR delivers continuous diagnostics for the entire enterprise threat landscape, processes countless network data points, senses abnormalities or threats, and reacts if necessary—all in a matter of seconds. The Arista NDP platform stands out from traditional security because it is designed to mimic the human brain. It recognizes malicious intent and learns over time, giving defenders greater visibility and insight into what threats exist and how to respond to them.

Get the Arista NDR Buyer's Guide and find out what your peers are saying about Arista NDR, Darktrace, Vectra AI and more!

Arista NDR is the #6 ranked solution in Network Traffic Analysis tools and #10 ranked solution in top Network Detection and Response (NDR) solutions. PeerSpot users give Arista NDR an average rating of 9.0 out of 10. Arista NDR is most commonly compared to Darktrace: Arista NDR vs Darktrace. Arista NDR is popular among the large enterprise segment, accounting for 66% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 16% of all views.

Helped 813,418 peers since 2012

Featured reviews

reviewer1506834

Head of Information Security at a engineering company with 10,001+ employees

One concern I do have with Awake is that, ideally, it should be able identify high-risk users and devices and entities. However, we don't have confidence in their entity resolution, and we've provided this feedback to Awake. My understanding is that this is where some of the AI/ML is, and it hasn't been reliable in correctly identifying which device an activity is associated with. We have also encountered issues where it has merged two devices into one entity profile when they shouldn't be merged. The entity resolution is the weakest point of Awake so far. Even without that it's useful because with the MNDR team, they'll at least do some of that work for us and then we can follow up on certain things. But that is something that we would want to see improved. Because we have the MNDR team, in some ways we don't work as hands-on with the interface itself as we did before. But another thing that would be helpful would be easier ways to integrate it with other systems. The integrations seem to exist, but they're a little weak in terms of how easy they are to set up, or what kind of information can be pulled in. That's something they've said that they're working on, as part of their roadmap, but that is something that I would like to see improved.

Read full review

reviewer1719513

Chief Technology Officer at a financial services firm with 11-50 employees

We take in IOCs from my SOC and from AlienVault, and then we focus on traffic that hits IOCs and alerts us to it. The one thing that the Awake platform lacks is the ability to automate the ingestion of IOCs rather than having to import CSV files or JSON files manually. Awake didn't support the manual importation of CSV and JSON in version 3.0, but they added it in version 4.0. It's helpful, but it still has to be a specific CSV format. Automated IOCs are on the roadmap. Hopefully, they will be able to automate the ingestion of IOCs by Q1 next year. I'm currently leveraging Mind Meld, an open-source tool by Palo Alto, to ingest IOCs from external parties. I aggregate those lists and spit them out as a massive list of domains, hashes, file names, IPS. Then we aggregate those into their own specific categories, like a URL category. Awake ingests that just like the Palo Alto firewall does, and then it alerts me if traffic attempts to go into it. Some of that is already on the Palo Alto firewall, which blocks it, but that doesn't mean that there is no attempted communication. I want to know if there's a communication attempt because there might be an indicator on that specific device trying to reach an IOC. Yes, my Palo Alto blocked it, but there's still something odd sitting there, and what if it can reach a different IOC that I don't have information about? I want to focus on it. I could do that by leveraging Awake if it could ingest the IOCs automatically. That's something I leverage Awake for today. I still have to manually import it, which is cumbersome because I have to manipulate the files that I get from the different IOC providers into a specific format that it understands. Once they add the ability to automate that, it'll be more useful.

Read full review

David Saville

Senior Systems Engineer at WealthCounsel, LLC

One thing I would like to see is a little bit more education or experience on AWS cloud for their managed services team. We've explained how we have the information set up, that the traffic coming in goes to the AWS load balancer and then gets sent on to our internal servers. Because we are grabbing traffic behind that load balancer, it shows the source IP of all traffic coming from the load balancer. In reality, you need to look at the exported, four-header IP to see where it's actually coming from. I've explained that to them several times, but when I get notices they always tell me this traffic is coming from the IPs belonging to the load balancers, not the source IPs. So a little bit more education for their team about how AWS manages the traffic might help out. They might also be able to improve on the cloud side. Right now we're in the process of migrating all of our on-prem stuff to just the AWS cloud. We'll be utilizing this service as AWS-only. They said that we can set it up that way, but without the hardware appliance, I'm curious to see how that goes. It seemed to me, when we were setting up, that the AWS portion was still in its infancy, and still being tested or developed. It works great, but it did take a bit of work to get set up, so I'm curious to see how having the entire solution in the AWS cloud works. I'm hoping it works well when we do that migration in the next month or two.

Read full review

Arista NDR mindshare

Product category:

As of October 2024, the mindshare of Arista NDR in the Network Detection and Response (NDR) category stands at 5.7%, down from 5.7% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Network Detection and Response (NDR)

Key learnings from peers

Last updated Aug 6, 2024

Valuable Features

Arista NDR's most valuable features include its intuitive query language, dashboards, and Security Knowledge Graph, which offers meaningful data visualization. Its behavior-based machine learning ensures high-fidelity anomaly detection. The platform's AI and machine learning capabilities minimize false positives and enhance traffic analysis, including encrypted traffic. The managed services provide expert threat-hunting and incident response. Users appreciate its ease of use, real-time traffic analysis, scalability, and ability to integrate with existing hardware for enhanced visibility and detailed insights.

"Arista NDR's scalability is very good, making it easy to add more hardware components. You can order additional hardware and integrate it by stacking it with the existing setup. This feature cannot be seen in other NDR tools."
"When I create a workbench query in Awake to do threat hunting, it's much easier to query. You get a dictionary popup immediately when you try to type a new query. It says, "You want to search for a device?" Then you type in "D-E," and it gives you a list of commands, like device, data set behavior, etc. That gives you the ability to build your own query."
"The interface itself is clean and easy to use, yet customizable. I like that I can create my own dashboards fairly easily so that I can see what is important to me. Also, the query language is pretty easy to use. I haven't needed to use it a ton, but as I need to go in and do different queries based on their requests, it has been fairly simple to use."

Room for Improvement

Arista NDR's query language needs to be more user-friendly, particularly for new users. Users seek better encrypted traffic handling, enhanced interface layout, and the integration of STIX/TAXII in IOC format. Improved API development, easier tool integration, and the ability to automate IOC ingestion are desired. The entity resolution needs reliability improvement, and there's a call for more AWS cloud education and cloud capability. Users also desire increased visibility in the Middle East and hiring more engineers.

"Arista NDR needs to open legal offices to be closer to customers and partners. It needs more visibility in the NDR market in the Middle East. While they are doing well, they lack sufficient engineers. They need to hire more engineers to meet the demand and expand their presence. The current team is good but not enough to fully capture the market."
"The one thing that the Awake platform lacks is the ability to automate the ingestion of IOCs rather than having to import CSV files or JSON files manually."
"One thing I would like to see is a little bit more education or experience on AWS cloud for their managed services team. We've explained how we have the information set up, that the traffic coming in goes to the AWS load balancer and then gets sent on to our internal servers... but when I get notices they always tell me this traffic is coming from the IPs belonging to the load balancers, not the source IPs. So a little bit more education for their team about how AWS manages the traffic might help out."

ROI

Users experienced significant return on investment from Arista NDR. They gained network visibility, quick threat detection, and remediation capabilities. The savings included time and costs of preventing data breaches and improving security controls. Arista NDR allowed resource reallocation and provided peace of mind, reducing potential financial impacts from security incidents and enhancing security posture, contributing to compliance and audit readiness.

Pricing

Arista NDR employs an annual subscription model with no extra costs applying to standard licensing fees. Many users found it competitively priced compared to alternatives like Darktrace, often with better managed network detection and response services. Discounts for long-term agreements were common, offering significant savings. Costs may vary when pivoting to cloud data capture but generally remain minimal. Users perceived the investment as worthwhile given the comprehensive services and capabilities provided.

"Because I represent a hedge fund, I have some leverage. I told them that they had to meet my conditions if they wanted me as a client. It was the same way with Awake. They wanted an initial four-year agreement. Initially, we signed on for a one-year contract, but they wanted the four-year deal when it came time for the renewal. I told them that I was not doing that. I said that they either had to do it on my terms, or I'd go somewhere else."
"Awake's pricing was very competitive. It's not a cheap option though. It's an investment to utilize it, but it's one that we decided was worth the cost, with the managed services. At our scale, it was a much better option to utilize their software and their managed services to handle this, rather than hiring another person to be an analyst. It was quite cost-effective for us."
"The pricing seems pretty reasonable for what we get out of it. We also found it to be more competitive than some other vendors that we've looked at."

Popular Use Cases

Organizations primarily use Arista NDR for network traffic analysis, threat-hunting, and enhanced network visibility. They monitor lateral traffic, detect threats like ransomware and data exfiltration, and ensure compliance with regulations like GDPR. Arista NDR is deployed for deep packet inspection, incident response, and alert generation. Its managed services support resource-constrained security teams, providing actionable insights and alerts for network-based security across various environments, including on-premise and cloud.

Service and Support

Arista NDR provides exceptional customer service with quick, proactive responses and strong user relationships. They address issues promptly, often notifying users before problems arise. The support team is highly experienced, offers dedicated assistance, and regularly communicates to optimize system performance. Users appreciate the advanced features and customization capabilities added based on feedback. The managed network detection and response service offers significant expertise, assisting with threat detection and giving users confidence in their security posture.

Deployment

The initial setup of Arista NDR was consistently described as straightforward and easy. Organizations emphasized its plug-and-play nature, with most installations taking a few hours to a week. There were minimal issues, such as logistical challenges and minor configuration adjustments. Deployments involved simple steps like racking the appliance, connecting it to TAP or SPAN ports, and occasional remote assistance from Arista NDR's team.

Scalability

Arista NDR is perceived as highly scalable, capable of accommodating increased usage and additional locations effortlessly. Users appreciate its adaptability to different network environments, ease of scaling with additional appliances, and straightforward setup for expanded capacity. It's particularly valued for managing large networks, supporting cloud integration, and being straightforward to enhance as demands grow. Arista NDR meets varying organizational needs and scales seamlessly with growing infrastructures.

Stability

Users report Arista NDR as highly stable, with minimal incidents typically related to updates. They appreciate the proactive update process and seamless performance. Administrators find maintenance low-effort, involving mainly user management. Stability impacts are negligible, and the system maintains consistent uptime. Feedback indicates improvements in bug handling, especially post-Arista acquisition. The platform is considered one of the most reliable, with users experiencing no significant downtime and smooth, regular upgrades.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Arista NDR Buyer's Guide for additional reliable information.