I have had challenges in the past with Trellix Collaboration Security for implementation because of issues related to compatibility. Since we worked in a global company with different operating systems, it was necessary to create different plans and different actions to implement the product.One thing I really do not prefer in Trellix Collaboration Security is not related to the console. I am a McAfee fan since the McAfee tool, and I find the console of Trellix Collaboration Security to be very user-friendly and easy to use. However, I do not know if it is related to the architecture of the product. Of course, we have modern threats based on behaviors and zero days. We have today CrowdStrike and SentinelOne, where we have better results based on threats and behavior, where it is possible to create a simulation environment based on the file detected and based on it, confirm if it really is malicious or not. In general, I believe Trellix Collaboration Security improved the console based on the last console of McAfee, but I think it is possible to improve more. It really is a good product, but in my view, it needs to improve detection based on behaviors. Regarding automations, I have implemented Trellix Collaboration Security here at Johnson & Johnson, and I implemented it in the same situation at Santander Bank and BNP Paribas Bank, where I created automations to export data for different metrics, including malicious detections, compliance, baselines, scans, last scans based on the seven days, and checking of patterns. I export everything to CSV files. Based on that, I create Power BI dashboards, and in these Power BI dashboards, I have a more executive view for different metrics to provide to myself, my manager, or director to create an executive view based on it. Another important point we use here at Johnson & Johnson and other companies is a data hub or a SIEM solution, such as Elastic or ArcSight, where we select some logs to be sent and use it to build reports and metrics.
