Try our new research platform with insights from 80,000+ expert users

CrowdStrike Falcon vs Cybereason Endpoint Detection & Response vs OpenText Behavioral Signals comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

Extended Detection and Response (XDR)
Endpoint Detection and Response (EDR)
Security Information and Event Management (SIEM)
 

Featured Reviews

Waleed Omar - PeerSpot reviewer
Provides effective real-time threat detection with potential for cost optimization
Some features such as device control, firewall management, and file analysis are standalone products that we need to purchase separately. If these features came out of the box within the product, it would be much more beneficial for us. Other providers such as SentinelOne include these features in their base product. We attended a CrowdStrike Falcon event where they discussed some shallow AI features, but we cannot see these in our panel yet. We work with different solutions such as Darktrace and SocRadar, where AI features are automatically displayed in our dashboards after release. However, for CrowdStrike Falcon, we cannot see these features.
AtulChaurasia - PeerSpot reviewer
Scalable platform with intuitive features for detecting malicious files
The initial setup process is straightforward. We have to install the agent, create a package, and deploy it on servers. It has a prebuilt console managed by the cloud team of Cybereason. We don't have to worry about the console and concentrate on endpoint implementation. It takes ten days to deploy it on 10,000 devices.
Nagendra Nekkala - PeerSpot reviewer
A user-friendly solution that can be used to integrate the logs properly with different connectors
ArcSight Intelligence is easy to maintain; one person is enough for the solution's maintenance. The maintenance person will add new features or devices, make policy changes or configurations, and learn and guide other engineers about new threats. ArcSight Intelligence is a user-friendly solution, and users should buy it if their company can afford its cost. Overall, I rate ArcSight Intelligence a nine out of ten.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We are happy with CloudStrike's ease of use and touch notification."
"The most valuable feature of CrowdStrike Falcon for me is its unified sensor, applicable across all models."
"CrowdStrike provides a lot of visibility in their tool."
"It's ability to do threat hunting is really great, quite robust, and even allows you to do hygiene stuff."
"I have found the connection to search the hosts for detections very useful in CrowdStrike Falcon."
"It has an extremely low footprint, so it has got minimum impact on the user end points in terms of CPU and memory usage."
"The scalability is good."
"Their endpoint is pretty flawless. There is no lag on the machines at all. Even though I have a good overview of all the machines, that's pretty much the most valuable feature of CrowdStrike Falcon."
"The initial setup process is straightforward."
"Immediately we can pick up the computers in the network if any malicious operation that is triggered."
"For me, the technical support is good."
"They do a very good job of providing multi-stage visualizations of malicious operations that immediately show all attack details across all devices and users. Since it is MalOp-centric model, you can see if there has been a similar operation across multiple machines. If it is the same thing appearing on multiple machines, you see all the machines and users affected in one screen."
"Cybereason's threat hunting and investigation are the most valuable features. Threat hunting is a user-friendly feature that keeps you safe. Investigation offers an added value that I haven't seen with other EDR services. It allows you to find specific policy problems within your environment."
"Cybereason absolutely enables us to mitigate and isolate on the fly. Our managed detection response telemetry has dropped dramatically since we began using it. It's very top-of-mind. We were running some tabletop exercises and none of the detections were getting triggered by the managed security services provider. So we needed to find a solution that would trigger high-fidelity alerts. That was Cybereason and it dramatically changed our landscape from the detection and response perspective."
"The interface is user-friendly."
"The initial setup was straightforward."
"The platform helps us improve threat detection capabilities."
"We found the correlation engine to be very good. It takes logs from different types of devices and does the correlation in a good way."
"The ability to tailor an environment to suit our specific use cases is a major advantage of ArcSight compared to other logging servers such as Splunk."
"The most valuable feature of ArcSight Intelligence is a single console where the entire dashboard gives all the connected details in a single place."
"The product has a valuable interface."
 

Cons

"During these two years with CrowdStrike Falcon, I certainly faced some problems, including the known CrowdStrike outage, which was quite pinching and brought many of the Windows-related services to a halt just because of one bad configuration push from CrowdStrike tracks."
"It does take more time to scan than other solutions."
"The solution could improve the policies themselves. It would be helpful if there were cost-cutting measures."
"Falcon could be improved with more function on the mobile end of things and better optimization with mobile devices."
"Threat prevention should be their first priority, and false positive reductions are needed."
"I would like a centralized deployment where I could roll out or push it to all endpoints."
"The biggest issue with Falcon as a standalone product is it doesn't have very much reporting."
"This solution could be improved with greater scope for admins to make changes to the solution."
"The integration with Microsoft solutions and Microsoft capabilities needs to be improved."
"There is room for improvement in the product features related to device control, particularly USB management."
"They need to improve their technical support services."
"I feel it is a shame that I cannot create groups of groups with inheritance."
"Ad hoc higher-level reporting to senior management can be improved or can be implemented. That's definitely an area of improvement that they need to focus on."
"The product's reporting isn't great."
"Cybereason does not have sandbox functionality."
"The reporting feature needs improvement."
"We haven't found the product fully scalable."
"The frequency of the updates that we are getting can be improved because the number and types of incidents that are happening at the global level are far more than what we are receiving. The frequency of updates feeds related to our rules should be increased. There should be more frequent information about the new rules that are coming and the global threats that are happening. There should be better options for dashboard creation. At present, the dashboards are good, but there is scope to make them better."
"ArcSight Intelligence is a bit slower, and its speed should be improved."
"ArcSight Intelligence's pricing needs improvement."
"The dashboard is not user-friendly and is in black and white."
 

Pricing and Cost Advice

"The product is expensive."
"The pricing and licensing are reasonable. I don't think we are getting charged more than what it is worth. It is fair, but I do not like how it is a la carte. I realize they do that so other organizations can buy and get the agent, getting it cheaper than you could otherwise. However, if you want the main core package, which has all the main features with the exception of maybe the multi-cloud protections, that can get pricier for an organization. So, you have to pick and choose what you want. I do not care for a la carte pricing."
"Crowdstrike Falcon is relatively cheap."
"This solution has a very competitive price."
"The pricing could be reduced. If it was more reasonable that would be great."
"Different components are additional price points. We got the components that were right for us, but other organizations may require more (or less) components to suit their needs."
"The price is fixed with no room for negotiation."
"The licensing model is straightforward. We choose the features we want and we then can download the package we want."
"On a scale of one to ten, where one is cheap and ten is expensive, I rate the pricing an eight."
"The pricing is manageable."
"I had to go through a third-party to purchase it, which I wasn't really pleased about."
"We considered a few other solutions. Some were ridiculously overpriced, while others didn't have solutions for Mac endpoints. That was a deal-breaker because most of our organization is on Mac. It came down to two vendors: Cybereason and another. They had similar pitches and almost identical approaches, but in the end, Cybereason gave us the best value for our money."
"In terms of cost, this is a good choice for our needs."
"I do not have experience with the licensing of the product."
"Though it is not the cheapest solution but it fits our budget. We pay an annual licensing fee."
"In terms of pricing, it's a good solution."
"It is an expensive platform."
"Its price is average and not very high. Splunk might be a bit cheaper than this. Its licensing is on a monthly basis."
"They offer perpetual licenses for the product."
"The solution is expensive and only suitable for enterprise environments."
"ArcSight Intelligence is an expensive solution."
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
862,077 professionals have used our research since 2012.
 

Comparison Review

it_user186927 - PeerSpot reviewer
Feb 16, 2015
Cybereason vs. Interset vs. SQRRL
Capture DB - they all use NoSQL db and hence solve the ad hoc query and 'go back in time' problem with current best of breed SIEM and DLP solutions that rely on real time analysis of incoming logs (and don't store them). This means deeper and quicker iterative threat analysis and assessment…
 

Top Industries

By visitors reading reviews
Computer Software Company
15%
Financial Services Firm
10%
Manufacturing Company
9%
Government
7%
Computer Software Company
16%
Financial Services Firm
11%
Manufacturing Company
8%
Government
6%
Government
18%
Computer Software Company
16%
Manufacturing Company
7%
University
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How does Crowdstrike Falcon compare with Darktrace?
Both of these products perform similarly and have many outstanding attributes. CrowdStrike Falcon offers an amazing u...
How does Microsoft Defender for Endpoint compare with Crowdstrike Falcon?
The CrowdStrike solution delivers a lot of information about incidents. It has a very light sensor that will never pu...
What is your experience regarding pricing and costs for Cybereason Endpoint Detection & Response?
Comparison with other products showed it be cheaper than some larger competitors. Set up cost for us were cheaper as ...
What is your primary use case for Cybereason Endpoint Detection & Response?
We use it to improve detection in the whole industrial sector. We are a big energy company. Across multiple endpoints...
What do you like most about ArcSight Interset / Intelligence?
The platform helps us improve threat detection capabilities.
What needs improvement with ArcSight Interset / Intelligence?
The product could be improved in several areas; it currently requires significant enhancement. Compared to QRadar and...
 

Also Known As

CrowdStrike Falcon, CrowdStrike Falcon XDR, CrowdStrike Falcon Threat Intelligence, CrowdStrike Identity Protection, CrowdStrike Falcon Surface
Cybereason EDR, Cybereason Deep Detect & Respond
ArcSight Interset / Intelligence, FileTrek, Interset UEBA, Micro Focus Interset UEBA, Micro Focus Interset, ArcSight Interset
 

Overview

 

Sample Customers

Information Not Available
Lockheed Martin, Spark Capital, DocuSign, Softbank Capital
Accuvant, Splunk Inc., NuTech, Box, rSolutions, Voodoo Technology Limited
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Extended Detection and Response (XDR). Updated: July 2025.
862,077 professionals have used our research since 2012.