The best features that Red Canary offers is the attack timeline. For example, if a suspicious file is opened, we can follow what happened after that, what process started it, and what other activity followed, and whether the machine made unusual connections. We can see those events, which makes investigations much easier. I also appreciate the 24/7 monitoring. We don't have to depend completely on our team or me being available. If something suspicious happens outside our working hours, Red Canary can investigate it and escalate it to us when action is needed. The feature I had forgotten to mention, and we use it mostly, is the threat detection. When Red Canary sees something unusual, it doesn't give us just an alert. It gives us more information about what happened and activity around it. The biggest impact that Red Canary has had for us positively is reducing the amount of time I and our team spend investigating security alerts. When we were using traditional antivirus tools, we could spend a lot of time collecting logs and checking different tools just to understand whether an alert was actually malicious or not serious. With Red Canary, we can get the investigation context and timeline much earlier. For example, for a normal endpoint alert that could take us sixty minutes or one hour to investigate, it can be understood within less than five minutes.
