Try our new research platform with insights from 80,000+ expert users

Fortinet FortiEDR vs Fortinet FortiSandbox vs Trellix Network Detection and Response comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Mindshare comparison

Endpoint Detection and Response (EDR)
Advanced Threat Protection (ATP)
Advanced Threat Protection (ATP)
 

Featured Reviews

Jovan Jovanovic - PeerSpot reviewer
Collects valuable endpoint data with good analytics and helpful scalability
This is a question for the partners who implement and install it. I am not involved in the implementation process, so I cannot suggest improvements. As mentioned, this is a query for my presales team, not me. I am part of the security team lead, focusing mainly on sales. Regarding the product, Fortinet could consider reducing the minimum order quantity for EDR, currently set at 500 pieces. In smaller markets like Serbia, Bosnia, Montenegro, and Slovenia, it can be challenging to find customers with 500 endpoints. My suggestion to Fortinet would be to lower this minimum order quantity to one.
Abdelhamid Saber - PeerSpot reviewer
Enhanced network security with adaptable integration and really good support
We use FortiSandbox for scanning files and images that pass through our networks. It integrates with different devices, such as five adapters and other Fortinet devices It is time-saving and more secure. It saves us from a lot of antivirus and anti-malware issues. The adapter is beneficial as it…
BiswabhanuPanda - PeerSpot reviewer
Offers in-depth investigation capabilities, integrates well and smoothly transitioned from a lower-capacity appliance to a higher one
The in-depth investigation capabilities are a major advantage. When the system flags something as malicious, it provides a packet capture of that activity within the environment. That helps my team quickly identify additional context that most other tools wouldn't offer – like source IP or base64 encoded data. We can also see DNS requests and other details that aren't readily available in solutions like Check Point or others that we've tried. The detection itself is solid, and their sandboxing is powerful. There's a learning curve – you need a strong grasp of OS-level changes, process forking, registry changes, and the potential impact of those. But with that knowledge, the level of information Trellix provides is far greater than what we've seen elsewhere. The real-time response capability of Trellix has been quite effective, although it's not very fast. The key is this solution's concept of 'preference zero.' They don't immediately act on a zero-day. For example, the solution has seen a piece of malware for the first time. It'll let it in, then do sandboxing. Maybe after four or five minutes, it identifies that specific file's DNX Secure Store as malicious. At that point, they update the static analysis engine, and it gets detected if anything else tries to download the same file. There is that initial 'preference zero' concept, like with Panda. You may not hold traffic in the network. That's standard in the industry; we don't do much about it. To address that, we also have endpoint solutions. We use SentinelOne in our environment, which helps us identify threats like Western Bureaus and others.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Fortinet FortiEDR's scalability is quite good, and you can add licenses to the solution."
"Fortinet is very user-friendly for customers."
"The setup is pretty simple."
"This is stable and scalable."
"The solution's most valuable features are the investigation tab and the granular control that Fortinet provides."
"Ability to get forensics details and also memory exfiltration."
"The ease of deployment and configuration is valuable. It's very easy compared to other vendors like Sophos. Sophos' configuration is complex. Fortinet is a lot easier to understand. You don't need a lot of admin knowledge to do the configuration."
"It is very easy to set up. I would rate my experience with the initial setup a ten out of ten, with ten being very easy to set up."
"Fortinet FortiSandbox's most valuable feature is the security it provides against threats, such as ransomware. Additionally, it integrates well with APIs."
"The GUI makes administration tasks straightforward."
"FortiSandbox helps us handle unknown threats. Every vendor is competing for who can detect an unknown threat the fastest. Fortinet is competitive in the market."
"It is an easily scalable solution."
"The solution has the highest stability...The solution's setup is not complex as they are already included in Fortinet."
"The solution is easy to manage."
"The main benefit of Fortinet FortiSandbox is that it allows organizations to detect and prevent unknown threats from entering an infrastructure."
"The product is great. It can be deployed on the cloud or on-premises."
"It is stable and quite protective. It has a lot of features to scan a lot of malicious things and vulnerabilities."
"Application categorization is the most valuable feature for us. Application filtering is very interesting because other products don't give you full application filtering capabilities."
"The product has helped improve our organization by being easy to use and integrate. This saves time, trouble and money."
"The most valuable feature is the network security module."
"Trellix NDR provides an essential defense by automatically responding to network incidents that firewalls may not catch."
"Very functional and good for detecting malicious traffic."
"The sandbox feature of FireEye Network Security is very good. The operating system itself has many features and it supports our design."
"It protects from signature-based attacks and signature-less attacks. The sandboxing technology, invented by FireEye, is very valuable. Our customers go for FireEye because of the sandboxing feature. When there is a threat or any malicious activity with a signature, it can be blocked by IPS. However, attacks that do not have any signatures and are very new can only be blocked by using the sandboxing feature, which is available only in FireEye. So, FireEye has both engines. It has an IPS engine and a sandbox engine, which is the best part. You can get complete network protection by using FireEye."
 

Cons

"FortiEDR can be improved by providing more detailed reporting."
"To improve Fortinet, we need to see more features and technology areas at the endpoint level introduced."
"Once, we had an event that was locked and blocked, but information about it came to us two or three days later."
"When I implemented FortiEDR, it identified Cisco AnyConnect VPN as malicious data, which led to the VPN being cut off. Consequently, people could not work remotely from home."
"There's room for improvement in the quick response time and technical support for integration issues, especially when dealing with multiple vendors."
"The solution is not very user-friendly because adding exceptions or policies involves many steps."
"I would like the solution to extend beyond endpoint protection and include other attack surfaces such as other network components."
"The SIEM could be improved."
"Fortinet FortiSandbox should improve its performance and security accuracy to keep competitive with other solutions, such as IBM."
"If updated, Fortinet FortiSandbox could cover other risks."
"The integration is limited. The solution needs to offer better integration with multiple vendors."
"In the next release, I would like to see machine learning and anti-exploitation included."
"The reporting tools could be improved in Fortinet FortiSandbox."
"Most people are confused about how to use the right integration of the right Fortinet product."
"The use cases in Fortinet FortiSandbox are not good. It is difficult to upload a custom VM for Fortinet FortiSandbox. The integration of Fortinet FortiSandbox with other Fortinet or FortiGate firewalls is not good. VMs are already installed in the hardware and are working fine, but we tried to approve the custom VM many times but did not succeed."
"There could be more templates and a higher number of simulated VMs to configure more use cases. Sometimes we need to configure many use cases in many different environments, and if the number of VMs that we configure is limited, we have to remove some and reconfigure the environment if we need another environment."
"Improvements could be achieved through greater integration capabilities with different firewall solutions. Integrating with the dashboard itself for different firewalls so users can also pull tags into their firewall dashboard."
"There is a lot of room for Improvement in the offering, from cost to functionality. It is pretty straightforward to implement which is an advantage. However, it falls short in pricing, detection capabilities, and, most importantly, reporting and policy management."
"A better depth of view, being able to see deeper into the management process, is what I'd like to see."
"FireEye Network Security should have better integration with other vendors' firewalls or proxies, such as Palo Alto and Fortinet. Files that are being submitted should happen through the API or automatically."
"Its documentation can be improved. The main problem that I see with FireEye is the documentation. We are an official distributor and partner of FireEye, and we have access to complete documentation about how to configure or implement this technology, but for customers, very limited documentation is available openly. This is the area in which FireEye should evolve. All documents should be easily available for everyone."
"The Trellix solution could be improved by enhancing the Central Management Console for faster visibility, which would help in network detection response."
"The initial setup was complex because of the nature of our environment. When it comes to the type of applications and functions which we were looking at in terms of identifying malicious threats, there would be some level of complexity, if we were doing it right."
"Certain features in Trellix Network Detection and Response, such as using AL-type commands, may initially pose a challenge for those unfamiliar with such commands. However, once users become accustomed to the system, it becomes easier to use."
 

Pricing and Cost Advice

"It's not cheap, but it's not expensive either."
"I'm not familiar with pricing, but it looks a bit costly compared to other vendors I think."
"Fortinet FortiEDR is pretty cheap compared to other EDR products because it provides three-for-one contracts."
"I chose Fortinet FortiEDR because it's more cost-effective than competitors, potentially saving me up to half the price."
"The price is comprable to other endpoint security solutions."
"We got a good deal on licensing, so it is in the competitive range."
"The solution is not expensive."
"The pricing is typical for enterprises and fairly priced."
"FortiSandbox is a subscription that can be purchased from Fortinet directly. Only using FortiSandbox as features purchased as a subscription in the cloud."
"I rate the product's pricing a five or six on a scale of one to ten, where one is low, and ten is high."
"There are no costs in addition to the standard licensing fees."
"We are on an annual license to use the solution. We have an additional feature that is integrated with S5, which is working well."
"There are additional costs, which isn't included in the licensing fee."
"There is a license to use this solution."
"Fortinet FortiSandbox is a nominally priced product, so I would not say that it is a very cheap tool."
"Fortinet is more reasonable than Palo Alto."
"Because of what the FireEye product does, it has significantly decreased our mean time in being able to identify and detect malicious threats. The company that I work with is a very mature organization, and we have seen the meantime to analysis decrease by at least tenfold."
"When I compare this solution to its competitors in the market, I find that it is a little expensive."
"The tool is a bit pricey."
"There are some additional services that I understand the vendor provides, but our approach was to package all of the features that we were looking to use into the product."
"The pricing is a little high."
"The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced."
"FireEye is comparable to other products, such as HX, but seems expensive. It may cause us to look at other products in the market."
"The user fee is not as high but the maintenance fee is expensive."
report
Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.
860,632 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Manufacturing Company
8%
Government
8%
Financial Services Firm
8%
Computer Software Company
13%
Government
12%
Financial Services Firm
10%
Manufacturing Company
7%
Financial Services Firm
13%
Comms Service Provider
11%
Manufacturing Company
10%
Computer Software Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What's the difference between Fortinet's FortiEDR and FortiClient?
I suggest Fortinet’s FortiEDR over FortiClient for several reasons. For starters, FortiEDR guarantees solid protectio...
What do you like most about Fortinet FortiEDR?
We have FortiEDR installed on all our systems. This protects them from any threats.
What is your experience regarding pricing and costs for Fortinet FortiEDR?
It's reasonably priced compared to other vendors' similar products.
What do you like most about Fortinet FortiSandbox?
The real-time analysis capability of FortiSandbox is beneficial for email analysis.
What is your experience regarding pricing and costs for Fortinet FortiSandbox?
I think it's affordable. For the six to seven months of usage, the cost has been reasonable.
What needs improvement with Fortinet FortiSandbox?
We sometimes face a delay in email scanning due to not having multiple virtual machines. Improvements could be made i...
What do you like most about FireEye Network Security?
We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. Wi...
What is your experience regarding pricing and costs for FireEye Network Security?
While I do not handle pricing directly, it is known that there is a variety of customers with different licensing nee...
What needs improvement with FireEye Network Security?
The Trellix solution could be improved by enhancing the Central Management Console for faster visibility, which would...
 

Also Known As

enSilo, FortiEDR
FortiSandbox
FireEye Network Security, FireEye
 

Overview

 

Sample Customers

Financial, Healthcare, Legal, Technology, Enterprise, Manufacturing ... 
Lush, Barnabas Health, Options, Riverside Healthcare, Hillsbourough County Schools, Columbia Public Schools, Schiller AG
FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems
Find out what your peers are saying about CrowdStrike, SentinelOne, Microsoft and others in Endpoint Detection and Response (EDR). Updated: January 2025.
860,632 professionals have used our research since 2012.