Machine learning capabilities enhance risk management for financial industry deployments
What is our primary use case?
At my company, we usually use NetWitness Endpoint for our customers with a primary focus on the financial industry, where eighty to ninety percent of our deployments occur.
What is most valuable?
NetWitness Endpoint offers the capability of machine learning or artificial intelligence. It provides a risk score for each endpoint, which helps our SOC by giving information about the risk levels, whether high or medium. This information is perfect, allowing us to manage our time efficiently.
What needs improvement?
NetWitness Endpoint lacks automatic response capabilities. While it can be used for response, the process is manual, requiring the user to manually respond to alerts, which is not ideal. An improvement would be enabling automatic responses.
For how long have I used the solution?
I have had experience with NetWitness products for six or seven years.
What was my experience with deployment of the solution?
The initial setup is intermediate. It is neither very complex nor very easy.
What do I think about the stability of the solution?
NetWitness Endpoint is a reliable tool for threat hunting, even though it's not the best, it’s great.
What do I think about the scalability of the solution?
Depending on the size of the company, the deployment can require different levels of staffing. For a smaller company with about two to three hundred users, one person is sufficient. For larger industries with one thousand or two thousand users, two people might be necessary.
How are customer service and support?
I find the technical support for NetWitness to be good. I have experience with other products, and I prefer the support from NetWitness as they always respond.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
In my experience, solutions like SecureOnix, Exabeam, and Sentinel are also available, but I prefer solutions similar to NetWitness, QRadar, or Splunk that allow for deeper integration with more devices.
How was the initial setup?
The initial setup is of medium difficulty, neither too complex nor too straightforward.
What about the implementation team?
For deploying in a company of 200 to 300 users, only one person may be needed. However, for larger deployments, such as those involving 1,000 or 2,000 users, two people are required. For support, you may need two people, but for administration, only one person is necessary.
What was our ROI?
The use of the solution is profitable for the company, allowing for monetary gains from its implementation.
What's my experience with pricing, setup cost, and licensing?
NetWitness Endpoint is neither expensive nor cheap. It is priced intermediately compared to other solutions.
Which other solutions did I evaluate?
NetWitness is comparable to solutions like QRadar, Splunk, and FortiSIEM, whereas CrowdStrike and Sentinel one operate using different approaches.
What other advice do I have?
I rate the overall solution at eight out of ten. NetWitness Endpoint offers compatibility with various devices, making it preferable. I appreciate solutions that allow integration with many devices, albeit slowly, but providing opportunities for machine learning. I rate the solution eight out of ten.
Which deployment model are you using for this solution?
On-premises
