Cortex XDR by Palo Alto Networks alternatives and competitors

Microsoft Defender that you get by default on Windows is an unmanaged solution. It detects, but it is conventional EDR in the sense that it can detect malicious code on the machine, but it is not good from an enterprise point of view because you can't see what is being detected. The difference between Defender and Defender ATP is that you get what's called the execution chain, which is its classic use case. 

When I try to open an attachment to an email, Defender tells me that this is malicious, but when you are in an enterprise and you do receive an alert that the file is malicious, the problem usually for the analyst is that they don't know what the person clicked on. They know there was a malicious file but was it an attachment? Was it something on the USB stick? Did they download it from the internet? That's not clear. Defender ATP gives you the execution chain. In this particular example, you can see that it was outlook.exe that launched the suspicious file which then launched or tried to download various components. You can see the whole execution tree because very often, the initial thing you get is a dropper, which then downloads subsequent components, and very often, the subsequent components get missed.

It essentially gives you visibility into the execution chain. So, you are better able to do a risk assessment. For instance, if something came from Outlook, then you know that you need to go and look in exchange or look in the mail system. If the trigger came from winword.exe, then you know that it was a document, and the person had opened a document from the email. You might see Internet Explorer, when it was still there, spawn PowerShell or a command shell, which is unusual, or you might see calc.exe open a command shell. All of this detection is invaluable for identifying whether something is suspicious or not. Your EDR might not detect any of this, but ATP would see this suspicious sequence of opening and flag it. So, essentially it is the visibility and the ability to detect unusual behavior that conventional EDR would not necessarily do for you.

Its version is usually up to date. It is a cloud solution. 

Its visibility is the most useful part of it, and it also increases the effectiveness of your response. You spend less time asking the users the standard question of what did they click on. To which, they usually say that they didn't click on anything. You can go in ATP, and you can see that they opened an email and then clicked on a link, and the link is this. There is no hiding this. Users do lie.

You can detect threats that are not necessarily known because of a behavior. If you have Internet Explorer opening a command shell, that is not normal. That does not happen unless there is some kind of malicious activity. It is also very good for visibility into what PowerShell scripts do. PowerShell is a double-edged sword. It is very powerful, but in a lot of cases, there is no visibility on what it is doing. With ATP, we generally have that ability.

I like the process visibility. This ability to visualize how something was executed is valuable, and the fact that Defender ATP is also linked to the threat intelligence that they have is also valuable. So, even if you have something that doesn't have a conventional signature, the fact that you get this strange execution means that you can detect things that are normally not visible.

The other feature that I like in Defender is that because it is up in the cloud, when you're trying to do any kind of managed service, it is fairly easy to set up if you're just within one tenant, but there are a lot of things wrong with the way Microsoft does it as compared to other products like Palo Alto Cortex, SentinelOne, or CrowdStrike.

The catch with ATP is you have to have the right Microsoft license. The licensing of ATP is linked to the licensing of Office 365. You have to have an E3 or an E5 license. If you have a small office license, it is not possible for you.

Another challenge is that it is not a multi-tenant solution. Microsoft's tenant is a licensed tenant. I'm an MSSP. So, I have multiple customers. In Microsoft's world, that means that I can't just buy an E5 license and give that out to all my customers. That won't work because all of the customer data resides within a single tenant in Microsoft's world. Other products—such as SentinelOne, Palo Alto Cortex, CrowdStrike, et cetera—are multi-tenant. So, I can have it at the top of the pyramid for my analyst to look into it and see all the customers, but each customer's data is separate. If the customer wants to look at what we see, they would only see their data, whereas in the Microsoft world, if I've got multiple customers connected to the same Microsoft tenant, they would see everybody else's data, which is a privacy problem in Europe. It is not possible to share the data, and it is a breach of privacy. So, the licensing and the privacy aspect makes it problematic in some situations.

It is also very complicated. If you decide to outsource your monitoring through an MSSP, the model for allowing the MSSP to connect to your Defender cloud is very complicated. In Office 365, it is relatively simple, but because of the way it has been done in Defender—because Defender is not part of the same cloud—it is a mess. It is possible, and it is workable, but it is probably one of the most complicated integrations we do.

It is still clunky as compared to products like Cisco AMP, SentinelOne, and CrowdStrike. Microsoft took the Defender product, and they bolted on the extra features, but you can see that there are different development teams working on it. Some features are well integrated, and some features are not. They keep on improving it, and it is better than it was. It is better than an unmanaged solution, but it is far from perfect.

I have been using it for about two years. I've got a couple of customers today with it.

Its stability is lesser than some of the competition. I've seen machines having a blue screen. I've seen machines block, but it is usually a problem related to the lack of resources. I wouldn't deploy it on a machine with less than 16 gigs of memory. All the issues that we had on the laptops were essentially related to memory because it does all the analysis in memory, and it eats a lot of memory to do that. So, stability is more a function of making sure that your endpoint farm has what's available. If you've got less than 16 gigs, I would not recommend it. You need to either change your endpoints or consider using another solution because although it'll work, it can be very slow.

It is like Microsoft Office. Its scalability is good, but I don't know how manageable it would be on a big scale. The biggest deployment I've worked on was about 5,000 endpoints, and it seemed to be okay.

It is Microsoft support. It can be very good, and it can be very bad. It depends on who you get on the phone. I would rate them a five out of ten.

Neutral

It is very simple. You can deploy it through the normal tools that you use, such as SCCM. The deployment for it is linked back to your tenant. 

We use it as a headless install. It is pushed out onto all the machines. Our normal rollout process rolls out about 50 to 100 machines in no time. They can pull the agents from the internet, or they can pull the agents internally, deploy them, and turn them on. For an antivirus, it is quite quick.

In terms of maintenance, it is pretty much like other Microsoft solutions. If you are able to do the auto-update functions, that's good. The downside to it is that it is fairly heavy on network traffic. On one of the large deployments, we found we had problems with the internet gateway because the console and all the telemetry and everything else is in the cloud. It was problematic.

It runs in the background. It is like any other antivirus solution. Sometimes, it needs tuning. An example would be that we have developers who do a lot of source code compiling. They might have tens of thousands of files that get touched or accessed when they do a compile. We have to make sure that those particular file types and certain directories are not scanned on read when they're opened. Otherwise, what normally might take an hour to compile can take more than 12 hours. That's not a problem specific to Defender. It is a problem in general, but it is fairly easy to create profiles to say that for those particular groups of machines or those particular groups of users, these file directories are exceptions to the scanning.

The licensing fee is a function of your Office 365 license. The feature set you get is a function of the license as well. There is probably an E2 version, an E3 version, and an E5 version. There are several versions, and not all features are the same. So, you might want to check what features you're expecting because you might get shocked. If you only have an E3 license, the capability isn't the same.

You have to look at the total cost of ownership (TCO) because the license component is only one aspect of the block. So, if your internal IT teams know well about IBM cloud solutions, then Defender is very easy because there is nothing new. What hurts the projects is integration. It is a hidden cost because it is beyond licensing. It can be problematic if you don't have some of the other integration tools from Microsoft. So, if you don't have the package deployment platforms and all the cloud equivalents, then there is a lot of manual work involved.

The other aspect that comes into the cost is that there is an option to store. You can make the agents report a lot more information, but if you increase the storage, then you increase your Azure storage costs, which can be painfully expensive. You typically have about 7 to 30 days of basic detection data included, but if you want to keep a more detailed log so that your IT guys can go back and figure out what was going on, it would increase your storage requirements, and that can get expensive. I know customers who turned on some of the features to increase the detection rate, and they got a huge bill from Microsoft.

A weakness, as well as an advantage, of Defender is that it is always on the cloud. There is no on-prem. You deploy additional agents into the customer infrastructure, but the console and the feedback are through the cloud.

Customers often say that Microsoft has included it in their license. So, it is license-cost neutral, but just because it is included in the license and appears to be cheap, it isn't necessarily a good reason for doing it. It isn't equivalent to other EDR or XDR solutions, but to an extent, you get what you pay for. ATP is a work in progress. To me, it is not a complete product.

Customers also go for it because it gives them visibility, and it means it is one less system to manage. They have the license for it, and they just want everything in the same ecosystem. There isn't much that we can do about that. As an MSSP, we're agnostic from a technology point of view. If the customer says, "This is what we want to do," we'll take it over.

I would advise asking yourself:

• What do your endpoints consist of?
• Which operating systems, such as Windows, Linux, iOS, or Android, will you have to support? The functionality that you get depends on your license.
• What is it that you're trying to achieve by taking Defender? 
• Are there more capable XDR-type solutions out there? 

If I was comparing them, from most effective to least effective or least integrated, I would put SentinelOne, Palo Alto Cortex, Cybereason, Microsoft Defender, and Cisco AMP.

If you want to get into the advantages of XDR solutions, which is about the detection capability coupled with artificial intelligence (AI) and data leaking, then it may not be the solution that you want. If you also want to be able to do threat intelligence, it is not the solution for you. That's because essentially the threat intelligence features are not there. You can get some threat intelligence from Azure, Microsoft Sentinel, etc, but it is not in the product like with Palo Alto Cortex, SentinelOne, or Cybereason.

I'd give it a cautious six out of ten.

With its behavior forensic, advanced threat hunting, integrated response, and Threat Hunter capabilities, it provides good control over security and improves the security posture.

Symantec is a known name in the market for endpoint and server security. The baseline of their products would always be the same, and with the evolving threats, they are also changing the technology. For example, with ransomware or zero-day threats, you don't have any already-known bad files. So, you don't have a signature for those files. They need to be identified based on behavior. If any file is misbehaving, Symantec Endpoint Security can handle it. This proactive approach or IPS is a part of it. Another example would be that you download a PDF file, and this PDF file has a built-in script. When you open the PDF file, in the background, the script starts, but nobody knows that. If you install Symantec, it will see the behavior of the file. If any file other than the required file is being executed, it will detect that and protect the system from that. Recently, a bank had a breach. There was an attempt to copy a file, which was blocked. With threat analysis, we could see that the system was protected but the bad guy had already passed through or gotten inside the network. 

Their Threat Hunter team helps out to know what exactly happened and the type of breach. For example, you clicked on a link that copied malware on a system. Your system is infected but nobody knows how many systems are affected after you. The Threat Hunter team is very good and professional. They would check its footprint on every system. If you have a breach in your environment, you have to contact them to find out what exactly is happening.

Nowadays, people bring their own devices. Most of the time, you don't know what's installed on these devices, which is the biggest threat to the environment. Symantec provides protection based on the analysis of your application, its behavior, and the type of data being sent and received. Sometimes, when you connect your mobile to any other wifi, such as free wifi or hotspot, if there is anything malicious, it can stop the traffic.

It allows you to choose the policies that you want to implement. There are around 7,000 SCSC policies, and of course, you are not going to enable all of them. You can choose the policies that you want. 

It has various components that help you at various stages: pre-attack, attack, breach, and post-breach. It reduces the attack surface. There is a component for breach assessment, device control, application control, behavior analysis, and isolation. All these are a part of its attack prevention capabilities. It also protects Active Directory. There is a tool called Active Directory Defense to stop an attacker from taking control of a user. It detects credential theft and stops intrusion, which is something no other vendor is currently providing. It also allows you to auto-manage policies, and IPS and IDS are also already there. 

It is a complete and the best solution if your use case is small and you need more productivity and more security. With a single console, you get control over Mac, Windows, iOS, and Android. This control is most valuable. 

It provides complete protection with machine learning, behavior learning, and Global Intelligence Network (GIN). The threat intelligence generated by Symantec’s GIN is now a part of the solution. For any file that they find, they get the reference from GIN, and based on the value of their sensors, they are going to say whether it is a bad file or an okay file. This capability is very important.

If there is a suspicious file, it is put into a sandbox where Symantec does an analysis. After the analysis, Symantec marks the file as a risk, but it doesn't blacklist or block the file. If a file is already known to be harmful, I would like them to automatically block or blacklist it to reduce the damage. It will stop the attack by at least 50%. Sometimes, administrators do not see the console on a daily basis, and sometimes, they assume that Symantec will block and delete the file, which is not the case. I would like it to block the file so that you won't be able to open the file. 

Another improvement area is reporting. Its reporting is more technical. As a technical person, it gives me 100% value, but if someone from the business staff wants to see what exactly is going on, you cannot give them these reports, and they won't get the value out of it. Currently, the data is not presentable for any C-level person.

I have been using this solution for the last four to five years.

They have been a leader for the last couple of years. There is no question about its productivity. It is a good name in the market. Every six and seven months, they are adding a new component or feature. If they see any gap in the product, they fix it. 

Their support is good. I would rate them a seven out of ten. Their response time varies. If your case is assigned to the India side, they take extra time. They will ask you for the log files, and the next day, they will do a remote session. Sometimes, the client gets frustrated because this is a security component, and they want to resolve the issue as soon as possible. If the case is assigned to someone on our side and we get a highly qualified person, they can handle it within a day.

Neutral

I got a chance to work with other products, such as Carbon Black, Palo Alto, and McAfee. They all are very good products. No product is bad because they are coming after so much R&D. They all are investing their time, money, and people to enhance productivity, but Symantec has been there from the start. The way they design their solutions is very important, and now, they have GIN, which is very important.

I once deployed Cylance in a bank. It had endpoint protection and EDR, and two agents were installed on the system. One was for protection and one was for recording the incident on EDR. It would capture so many files, which Symantec doesn't do, and mark them as harmful or not. Based on what I was told, it decided that based on the virus total. When they get the file hash, in the back end, they would run a script, scan it, and then give a report based on the virus total. They don't do any technical evaluation of file structure or file behavior. I found Java files to be a big problem with that solution. Symantec is comparatively a much more mature solution, and their support is also very good. They provide support for the whole product and not just a component.

It offers flexible management and deployment options. You can install it by watching a video on YouTube, but for the implementation design, expertise is required. For example, if you are implementing it in a big bank where you have 5,000 to 6,000 endpoints and multiple branches, you need to have an implementation strategy and see how to take care of the database, replication, and other things. At that time, your expertise is going to be used for designing the solution.

It takes about 30 minutes to implement the server and the policies. The rest of the things are going to be installed by the agent, which is dependent on the network. In the same building, if you have SCCM or another deployment tool, it is a one-hour job, and it can be done by one person.

In terms of maintenance, you have to take care of your server and download the updates on a regular basis. This is only for Symantec Endpoint Protection Manager (SCPM). If you are a cloud site, you don't need that. Symantec will do it. For on-prem, you need a person to log in and do the updates, and there might also be a little bit of maintenance of the database.

You get the ROI within the licensing period. It is also in terms of the reputation of an organization. Especially if you are a financial institution, your environment needs to be secure.  Last year, a bank in Nairobi, Kenya had an issue with the system. When I inspected it, five systems were already breached. I didn't find their cybersecurity team competent enough. So, I told their CIO to buy this product and enable all the policies. They don't need to log in daily. When required, they can log in and get all the information. They are very happy with it. The only issue is that when a file is identified as a risk, it is not blocked.

It is normal. If you are an educational institute, they give you a very good discount. If you are coming from the banking side, they may or may not give you a discount. I'm working with seven companies, and normally, they get a 65% to 70% discount on everything.

There are various components. You have to know what exactly you want. If you are just going to protect your endpoint, you won't buy Symantec Endpoint Security Complete. You would buy the Endpoint Enterprise, which is on the lower side. Symantec Endpoint Security Complete is on the higher side because you can also manage your mobiles and other devices. EDR is also a part of it, whereas, with the enterprise version, you don't get EDR. Overall, the price depends on the number of security components you want.

When evaluating a solution, I would advise seeing the simplicity of deployment and usage. Some products are cheap, but the operational cost is much higher, and they are a lot more complex. 

If your organization is small and you have a constraint on your system administrator or security administrator, then the cloud is the best solution for you. If you are a larger bank and you don't want your data to be on the cloud side because most countries don't allow you to share your data on the cloud side, you can install Symantec Endpoint Protection, which is then connected to a Symantec Endpoint SCSC. It will be a hybrid solution. Some components are going to be managed from on-prem and some components are going to be managed from the cloud. Feature-wise, if you're going to the cloud side, you can leverage EDR. Otherwise, you have to install an EDR server on your data center.

I would rate it a 10 out of 10. It is a wonderful product.

We're a partner of SentinelOne, but we're also a partner of many other companies. We're not a vendor per se. We sell SOC as a service, and as a part of that service, we provide protection solutions. My area is around antivirus. So, we are not a reseller in that sense.

I am using its latest version. It can be deployed on-prem as well as on the cloud. I have customers with a requirement for both. SentinelOne provides their own cloud because that's where they do their artificial intelligence (AI).

SentinelOne is what they call extended detection and response (XDR). So, it is the next generation of endpoint detection. The main difference between Endpoint Detection and Response (EDR) and XDR is that in XDR you have visibility on how something is executing. An EDR solution detects a suspicious or malicious package based on its signature or its behavior and sends an alert, but the problem is that you only see the file that it alerts on. For example, if it is an attachment to an email, you'll see the trigger on the attachment when you try to open it, but what you don't always know is from where that came. With an XDR solution like SentinelOne, you can see the whole process execution. You can say that it was executed from inside Word, Outlook, or something else. For example, when you opened an attachment in Outlook, it triggered Word and got opened in Word. This whole process execution is visible with XDR. It also offers the possibility to suspend or respond intelligently. So, you can use it not only to detect that the package is suspicious, but you could also suspend it so that when the person comes to investigate, the suspended process is still there.

The process visualization, automated response, and snapshotting are valuable. The integration and automation possibilities are also valuable.

The update process can be better. It is very easy to deploy, but over a long period, the updating process can be a little messy. In some EDR solutions, you end up with a very good mechanism to push new versions. It could do with a little work in that area. It is not particularly difficult, but it could do with a little work.

I have been using it for about a year and a half.

It gives good stability. It can have an impact on the performance of the workstation, but that is usually a question of tuning. From a stability point of view, I've never had a machine with a blue screen.

It scales very well.

They're excellent. I would rate them a five out of five.

Positive

We are technology agnostic in the sense that if a customer doesn't have a solution, we'll make a recommendation. If they don't have a solution, then our recommendation goes along the lines of SentinelOne, Palo Alto Cortex, Microsoft Defender ATP, or ESET. These are the ones that I typically would recommend, but Microsoft Defender ATP is problematic because you have to have the Azure and Office licenses to get it. For the other ones, you can buy the licenses separately. We also take over other solutions. I have some customers on Kaspersky and other solutions.

It is straightforward. If we deploy it from a URL where it downloads, it can be done in 10 minutes. If it is coming from an internal deployment server, it can be a few minutes. It is essentially headless. There are no prompts.

I have six people, but they normally work with the customers. As an MSSP, we normally work with the customer IT teams to deploy the agents in large companies. In small companies, it could be our people who do it. 

The number of people required depends on the number of endpoints, but generally, the number is low because it is a very simple installation. In fact, we even have end users running this.

It has the best ROI that I've seen. If I compare it to Microsoft Defender ATP or Defender for Endpoint, which a lot of people compare it against because it's included with the E3 or E5 Office licenses, Defender is three to five years behind SentinelOne. You're also tied to Microsoft's licensing scheme, whereas SentinelOne is independent of all of them. The ROI is very good. For me, its closest direct competitor is either Cybereason or Palo Alto's Cortex.

Its price is per endpoint per year. One of the features of its licensing is that it is a multi-tenanted solution. From an MSSP point of view, if I want to have several different virtual clouds of customers, it is supported natively, which is not the case with, for example, Microsoft Defender.

Another nice thing about it is that you can buy one license if you want to. Some vendors insist that you buy 50 or 100, whereas here, you can just buy one.

The Singularity product has three versions: Singularity Core, Singularity Control, and Singularity Complete. The Singularity Complete one is really what I consider an enterprise rate solution. The middle one, Control, is more than adequate. In terms of price, it works out very similar to what you would pay for Kaspersky or for any other solution. The licensing per endpoint, per year, and per version is progressively more expensive for the Core, Control, and Complete versions. 

The interesting thing is that it is possible to upgrade across the versions without a major change. If a customer buys the most basic installation and would like some of the features out of the middle, it is possible.

You have a choice between an on-premise console and the cloud. My advice would be to use the cloud, but it is a consideration of whether your endpoints can connect to the cloud or not. One of my customers is in the military defense area, and they have no connection to the internet. So, we had to deploy on-prem. What you don't get with the on-prem is all the AI. So, if you're deploying on-prem, you get the core features of SentinelOne, but you don't get all of the bells and whistles that you get from the cloud environment. The same is true for Cisco AMP and other solutions that are deployed on-prem. So, you need to consider how you're going to consume it if you have a disconnected network. If you're in the financial world, a lot of the production networks are not connected to the internet. So, solutions like Microsoft Defender are not an option because they're cloud-based, whereas SentinelOne is an option in those environments.

I would rate it an eight out of ten. It is a very good solution, but you have to compare it to understand it better.

I have a highly specific use case for Azure Defender, so I don't think I've used most of its features. We primarily use it to secure Kubernetes clusters in other cloud environments. For example, I have Kubernetes in Amazon AWS, and we're trying out Azure Defender to protect those Kubernetes clusters.

We also use Defender to scan the image repositories held in Azure Container Repository or ACR. We use Defender plus Azure ARC and Windows Defender. All three products work in conjunction to give us some security insights into our cluster.

We haven't fully implemented Azure Defender yet. Right now, we're at the POC stage. However, if people have a genuine use case, they should see its value, especially because of its cross-cloud compatibility. I don't think any other tool provides the same cross-cloud compatibility as Azure Defender combined with Arc, so that's a significant selling point for this product.

The security scorecard is something I find helpful. It tells me what's missing and identifies new vulnerabilities inside my registries. Once I publish the image, the scorecards automatically update. I don't need to constantly run a security scan for my images because the scorecards are updated by Azure periodically. That makes my job easier.

I haven't been using Azure Defender for long. It's been around three months. 

Overall, Azure Defender's availability is excellent. However, the Kubernetes security is a new offering that is still under development, so the service's availability and support are not mature at this point and definitely need improvement.

I rate Defender's scalability about eight out of 10. If you compare Azure Defender to a similar product AWS offers, there isn't much difference in scalability. The solution is able to accommodate all your requirements. I don't think I have ever reached a point where the solution couldn't scale to meet my needs. 

I deduct two points because you incur more costs as you increase usage, so it's more expensive when you have lots of logs flowing into the system. That is why I rate it eight. Otherwise, I don't see any technical issues there.

Azure's system could be more on point like AWS support. For example, if I have an issue with AWS, I create a support ticket, then I get a call or a message. With Azure support, you raise a ticket, and somebody calls back depending on their availability and the priority, which might not align with your business priority. 

I can't talk about Microsoft support generally, but I can speak to my experience specifically with Azure Defender support. I would rate it five out of 10. Maybe it's because this is a product that Azure is still developing on the side. I don't think they have made Azure Defender for Kubernetes available to the general public yet, so that could be why their support is not up to par. I don't know the reason, but I haven't had a good experience with the support.

It is just a POC, so I don't have many endpoints. The whole setup took three days for around 10 endpoints. They have an agent-based security system. It's always complex because you need to deploy the agent to all endpoints which is a lot of work to get it set up. 

We have still have not decided to implement Azure Defender because we are also trying out other products in the same line. Once the RFP process is finished, we will know which one we'll implement.

Azure Defender is definitely pricey, but their competitors cost about the same. For example, a Palo Alto solution is the same price per endpoint, but the ground strikes cost a bit more than Azure Defender. Still, it's pricey for a company like ours. Maybe well-established organizations can afford it, but it might be too costly for a startup. They should try some open-source tools. That's how it is today.

Compared to other products, Azure Defender's main advantage is native integration with all Azure services. If your company uses Active Directory and builds everything on Azure, you get it as a complete package. There's no need to buy another tool and set it up in your cloud environment. 

Everything is built into Azure, and if we go for cross-cloud development with Azure Arc, we can use most of the features. While it's possible to deploy and convert third-party applications, it is difficult to maintain, whereas Azure deployments to the cloud are always easier. Also, Microsoft is a big company, so they always provide enough support, and we trust the Microsoft brand. 

I rate Azure Defender eight out of 10. If you're looking for standard Azure Defender services like cloud posture management or application security, these features are all highly mature. Defender also has newer capabilities that they recently introduced, such as endpoint security, cross-cloud integration with Azure Arc, and Kubernetes runtime security. 

These are all new services, so potential users need to think twice before buying into it solely for these features because I don't think the support is there to encourage customers to buy the product. I don't feel confident about Microsoft's support in these particular areas. I would exercise caution before buying Defender for these particular use cases. 

One of the features I like in Trend Micro XDR is that you can drill down on the root-cause analysis for anything you find on the solution. I also like that it works for detection purposes. Behavior analytics is also what I like most about Trend Micro XDR. I love that it has features such as behavior detection, program detection, and memory scanning. By default, the solution protects against spyware, apart from the normal virus scan. Smart Scan and DLP are also available in Trend Micro XDR which I like as well.

A room for improvement in Trend Micro XDR is more visibility into the alerts. We do get alerts from the solution, but when we are away, we need to have more visibility.

An additional feature we'd like to see in the next release of Trend Micro XDR is reporting, particularly RCA reports because those will help us a lot. Right now, we need to log into the portal to drill down the RCA. For example, when an alert comes in, it will be blocked immediately by Trend Micro XDR. We get the message "This has been blocked", but when we want to drill down in terms of where it started, we need to log into the server, do the RCA, and drill down on it. While doing the RCA and drilling down on it, it would be good if we could get a report directly from Trend Micro XDR because that report could help us.

We've been working with Trend Micro XDR for more than one year, and we're still using the solution.

During the first time we used Trend Micro XDR, we had some issues in terms of stability, but later on, everything became stable.

Trend Micro XDR is a scalable solution.

My impression of the technical support for Trend Micro XDR is good.

We compared Trend Micro XDR against CrowdStrike and Palo Alto, but in terms of the features and pricing, we went with Trend Micro XDR. The solution had a really good price and we are getting almost all the features.

The setup for Trend Micro XDR was easy and didn't have much challenges, especially because we have centralized management so it was easy to manage.

The first time we implemented Trend Micro XDR, we had an integrator because we were on Trend Micro Apex One, then we wanted to migrate that existing solution to Trend Micro XDR, so during that time, we needed an integrator for the implementation of the solution.

Trend Micro XDR has a good price, and on a scale of one to five, I would rate it a four out of five in terms of price.

My company evaluated CrowdStrike and Palo Alto.

My company is working with Trend Micro XDR, an advanced version of the EDR solution.

There are around six hundred users of this solution, but only one person required for its maintenance. Normally, my company deploys this agent. There's another tool from where my company pushes this agent to the end user, pulls to the end user system, then scans from this console, then my company gets all the reports.

I would rate Trend Micro XDR seven out of ten.