Secureworks Taegis Managed XDR / MDR Reviews

My client selected Secureworks Red Cloak MDR. I can't tell you why they chose this one over another solution. We presented two different solutions: Secureworks and Splunk, and they made the selection. They chose the one they felt more familiar with. My guess is probably the dashboard was better so that if and when they get queries, it was something that they were more familiar with. I know Splunk, so I'd have probably gone the other way, but that's just because it's what I know.

In terms of what could be improved, I really don't have anything to add to that. The client probably has a perspective on that but I don't.

I didn't deal with all aspects, just the set up, implementation and the tuning. But when it gets into what the licensing was and the cost, I wasn't involved, so I don't have any feedback on that.

In regards to maintaining the SIM, Dell does all of that. We were involved in helping them get the feed scan, helping them get set up, helping them do vendor selection. That was all when it came to the SIM. We have a lot more going on, other elements, but Dell provided a lot of those other services and we didn't have to get involved in that.

In terms of scalability, we didn't scale it very large. We're three business units, 13 sites, and around 2,500 users, so not a real huge company. I assume it's more scalable than that. It's not something we're concerned about here, and even with growth or percent growth, I didn't sense that there's any limitation on that. I would be surprised if we're anywhere near where we'd be concerned about scalability with them.

The initial setup was very straight forward.

In terms of ROI, I'd be surprised if there is any investment return on the SIM. They had no SIM before, so there's reputation and security and that they need to adhere to some kind of a framework. So they are moving that way.

On a scale of one to ten, I'd rate Secureworks Red Cloak MDR an eight, because it's been really good. I don't know everything about it yet.

The deployment was easy. We just put on some of the end points, so we're still talking about what's going on there. But to my knowledge, there's been no issues with it. It has a good reputation, so I don't really have a lot of insight to give you detailed feedback.

We primarily use the solution for log monitoring and network traffic analysis as well as alarming for security events. 

The solution is great for managing alerts and dealing with them as they arise.

There are some great automatic responses. It will immediately intervene and block malicious IPs and can quarantine systems. It's very good at keeping our systems safe. 

The pricing is flexible.

The solution could work on its simplicity. 

Dell Secureworks is for higher-end customers and it's not quite as straightforward to implement or to get up and running as some of the other solutions.

They do provide an engineer for the first few weeks to help you get things implemented, however, there's a lot of bells and whistles with Dell Secureworks. That's a disadvantage for smaller customers. With a lot of the other easier solutions available to smaller customers, you just stick a box in there and set it and forget. With Dell Secureworks it's more hands-on.

I've been dealing with the solution for two or three years so far. It hasn't been too long.

The team sometimes had to wait for alarms to be triggered when we're running tests. We found that it took a while sometimes for the alarm to trigger an incident and then for the engineers to raise the flag. Sometimes there's a lag time and that can be several hours, or even up to a day. They eventually do catch it. It could be faster, however.

The initial setup isn't really straightforward. It's quite involved and rather complex as the solution has a lot of bells and whistles. 

Dell provides an engineer for the first few weeks to assist with the initial setup.

At the end of the day, Dell came down to our budget. Initially, the cost was going to be something around $160 or $170. And eventually, I think they brought it down to $110 and they also threw in some endpoint protection platforms. They threw in some antivirus capabilities as well. We ended up getting a pretty good deal.

I'm not sure of which version of the solution we are using.

While my company doesn't have a relationship with them, our client who went with the Dell solution did have a pretty strong relationship with Dell already. They were able to leverage that relationship, and bought Dell hardware and so on. They were able to get some good people to demo and to discuss the MSSP solution for them.

It's an internal tool, it was developed internally. My sense is it's still got a ways to go in terms of having a shrink-wrap capability. If you want a shrink-wrap capability, you need to go with something smaller and something that's been out there on the market for a while. Red Cloak is more for internal Dell consultants. 

Overall, I would rate the solution at an eight out of ten.

We use Dell Secureworks as our SIEM solution.

The most valuable features are IDS and IPS.

The knowledge base is up to date and easy to use.

Log integration should be improved. If they can add SIEM, the event monitoring, then that would be great.

Scalability is an area that needs to be improved.

In the next release of this solution, I would like to see file integrity monitoring. I also hope that they will provide threat intelligence scripts for free.

I have been using Dell Secureworks for three years.

This is a stable solution.

I would rate the scalability at 50%. We have been having a problem as we are shifting from a previous appliance to a virtual machine. I think that it is an issue of scalability.

Our experience with technical support depends on the problem. Proactive support is good, but if it's something to do with health status then it is a hassle for us to find the correct department. We need to get a direct answer but it can take a lot of time.

The initial setup is straightforward.

I would rate this solution an eight out of ten.

At my last company, which was a small health care operator, I needed to outsource threat management and vulnerability management. And using DSW with Qualys, supported by Palo Alto next-gen firewall worked extremely well for us.

Solved a fundamental problem that lets us all sleep well at night! The service lived up to its reputation as a leader in the space. Not surprisingly, false positives happened, but forced us to register our preferred handling, which were consistently managed per preference going forward.

Support staff is excellent. Staff was always knowledgeable, available and eager to help. It was not unusual that a support person went above and beyond what I expected.

GUI for resolving tickets is terrible. Non-intuitive, offering a dizzying array of options, often none of which made sense even for common problems. I ended up choosing "Other" way more than I should have had to, to categorize an issue resolution.