

Trellix Network Detection and Response and ExtraHop Reveal(x) are competitors in the network security and monitoring space. ExtraHop Reveal(x) has the upper hand due to its strong network visibility and SSL decryption capabilities, which enhance real-time monitoring and integration options.
Features: Trellix Network Detection and Response provides zero-day attack detection, APT identification, and application filtering. It offers a reliable MVX engine, effective incident response, and a straightforward alert dashboard. ExtraHop Reveal(x) stands out with its network visibility, machine learning capabilities, and integration with various solutions. It provides customizable dashboards and can decrypt SSL traffic for anomaly detection.
Room for Improvement: Trellix Network Detection and Response needs enhancement in analytics, false positive reduction, and improved integration with other vendor tools and cloud support. ExtraHop Reveal(x) could improve with a longer look-back period, enhanced nesting in collections, and additional user training resources. Both products could benefit from improved support protocols and optimized pricing strategies.
Ease of Deployment and Customer Service: Trellix Network Detection and Response offers on-premises deployment with highly responsive customer service, known for its robust classic support system. ExtraHop Reveal(x) provides deployment options across hybrid, on-premises, and public cloud environments, with customer service also rated highly. Both could improve support and usability.
Pricing and ROI: Trellix Network Detection and Response is considered costly but delivers significant ROI by effectively preventing threats. ExtraHop Reveal(x) is also seen as expensive, requiring strategic planning for setup, yet provides good value by reducing breaches and enhancing productivity, affirming its ROI.
Investigations are generally faster because analysts have immediate access to relevant network context instead of manually piecing together information from multiple sources.
The time was reduced because of the automated detections.
If a threat can enter any endpoint that is exposed to the internal network, there is a potential gateway for hackers, leading to a loss of production or significant financial impact to the network.
I would rate their technical support nine out of ten.
The support team was responsive and knowledgeable.
Technical support needs improvement as sometimes engineers are not available promptly, especially during high-severity incidents.
They were constantly relaying our message to the engineering team and the engineering team was looping that back to them and then to us.
The scalability of Trellix Network Detection and Response is easy; I just have to add another license in the same cloud, and I can easily increase the number of endpoints.
Trellix Network Detection and Response has handled that growth while continuing to provide consistency, visibility, threat detection, and investigation capabilities.
The connectors were always out of sync and we have had multiple noise floods from these connectors which were not configured well.
In my day-to-day use, it has consistently provided the visibility and detection capabilities we rely on for security monitoring and investigations.
In our experience, it has had a positive impact on our production environment and has proven to be a dependable part of our security operations.
I encounter no issues with health or reliability when the recommended specifications are met.
Currently, we have to check manually as we do not receive any notifications about new patches, maintenance, or firmware releases.
I would like to see improvements in areas where events are getting dropped; we're not able to view complete insights.
There should be improvements in AI intelligence, faster decision-making, and a more responsive technical support team.
It would be best if Trellix Network Detection and Response sensors were converted into a next-generation firewall with built-in capabilities for routing, switching, and Layer 7 functionality, as most next-generation firewalls today include these features.
Regarding needed improvements for Trellix Network Detection and Response, there is always room for enhancement in terms of AI capability to include proactive triggers based on historical data, enabling AI to learn patterns and detect threats before they manifest.
Trellix Network Detection and Response is an enterprise-grade security solution, so it represents a significant investment, but we believe that the value it provides in terms of threat detection, network visibility, and incident response justifies the cost.
The pricing model is not transparent, as they do not provide pricing ranges upfront, complicating the evaluation of costs across regions.
My experience with the pricing, setup cost, and licensing of Trellix Network Detection and Response is that they are very good and affordable for the customer range.
If I want to know a specific IP and which server it has been connected to, it's easy to gather those kinds of trees from the NDR.
The solution offers a friendly GUI for security features.
Per day we used to have 70 to 80 alerts and those could be reduced up to 40 to 30 a day. This is almost a 40 to 50% decrease.
Trellix Network Detection and Response has positively impacted my organization by addressing performance issues, specifically by offloading heavy traffic inspection and SSL inspection through sensors due to the limitations of the firewall.
Visibility is very important as it empowers users to understand what is happening; therefore, detection is one of the strongest features of Trellix Network Detection and Response.
| Product | Mindshare (%) |
|---|---|
| ExtraHop Reveal(x) | 5.9% |
| Trellix Network Detection and Response | 3.0% |
| Other | 91.1% |


| Company Size | Count |
|---|---|
| Small Business | 3 |
| Midsize Enterprise | 4 |
| Large Enterprise | 9 |
| Company Size | Count |
|---|---|
| Small Business | 32 |
| Midsize Enterprise | 14 |
| Large Enterprise | 23 |
ExtraHop Reveal(x) offers advanced network visibility and threat detection through seamless integration with CrowdStrike. It enhances security with machine learning-driven behavioral analysis and customizable dashboards.
ExtraHop Reveal(x) excels in network detection and response by decrypting SSL traffic and providing real-time packet inspection. Users benefit from its dynamic triggers and historical data tracing. The platform is valued for its depth of information, powerful analytics, and cloud-based administration. It allows effective monitoring of attack chains and integrates with other solutions to boost security. However, there is room for improvement in pricing flexibility, licensing models, and integration capabilities, particularly with Microsoft Sentinel.
What are ExtraHop Reveal(x)'s Key Features?ExtraHop Reveal(x) is employed across industries for network traffic monitoring, malware detection, and real-time analysis. Analysts use it for server-to-server networking insights and application troubleshooting. Companies leverage its capabilities for behavioral analytics and compliance monitoring without deploying sensors on individual devices.
Trellix Network Detection and Response provides robust threat protection with advanced detection of zero-day attacks and APTs. Its user-friendly dashboard and real-time response capabilities enhance security and visibility across networks.
Trellix Network Detection and Response stands out with its MVX engine, leveraging virtual machines for comprehensive behavioral analysis. The solution supports detection of advanced cyber threats through features like sandboxing and application filtering, offering real-time response and packet capture for detailed contextual insights. Companies benefit from seamless integration with other platforms, enhancing usability and overall protection. User-friendly interfaces improve network visibility, while stability and ease of configuration safeguard against both signature-based and signature-less threats.
What key features does Trellix offer?Companies in sectors like finance, healthcare, and enterprise security utilize Trellix Network Detection and Response for tasks such as network intrusion detection, endpoint protection, and securing data transmission paths. It aids in threat investigations, pre-sales demos, and network forensics, reducing risks by protecting against cyber threats like phishing.
We monitor all Network Detection and Response (NDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.