My main use case for Red Canary is that a Red Canary analyst monitors our logs, and if they see any abnormality, they create a ticket that we use to analyze the situation. We assign that ticket and analyze it to ensure we have all the details needed. We use other tools to investigate, but we mainly rely on the evidence from Red Canary, and we can also use the isolate feature from Red Canary. There are threat reports and agents, and in our environment, we have endpoints and identity as well. A recent situation where I used Red Canary to analyze a ticket involved an employee from the US who logged in from the UK, a country he had never visited before. Red Canary's analyst assumed that account was compromised, but after analyzing using our other tools, it seemed the login was legitimate. The user confirmed he had traveled to the UK and used one of our company phones to log into the account to check emails, so the alert triggered was a true positive but a legitimate anomaly.
Head of Information Security and Privacy at Ovative Group
Real User
Top 20
Mar 25, 2026
My main use case for Red Canary is to ensure I can sleep at night by getting 24/7 coverage by a capable team to investigate any alerts for the systems that we have in place to ensure we don't have any security or suspicious activity. I can give you a specific example of a situation where Red Canary helped me out and made a difference: we've had more than a few instances where a user clicked on a phishing link, invoking connections to hostile sites. Through alerts in Defender, the Red Canary team identified, confirmed, and investigated the threat before they reset the user's credentials and contacted us to work with the user to resolve the situation. I have at least one other instance where Red Canary investigated an alert and continued doing additional investigations of logging and activity from that user and their systems around that proximity to confirm that there was no further suspicious activity.
We use Red Canary ( /products/red-canary-reviews ) to monitor incoming and outgoing traffic. For example, when we receive an alert that data from our internal IP address to an external IP address has been transferred, we investigate using a Palo Alto firewall.
Find out what your peers are saying about Red Canary, a Zscaler company, Microsoft, Fortinet and others in Advanced Threat Protection (ATP). Updated: October 2026.
Consultant at a financial services firm with 11-50 employees
Real User
Mar 28, 2022
We mainly used Red Canary MDR for detecting and containing suspicious or malicious behavior on an endpoint, whether it's a suspicious act that a hacker might be conducting or actual malware. We are using Red Canary MDR with Carbon Black. Carbon Black supports different EDRs.
Advanced Threat Protection solutions offer robust security measures to detect and mitigate sophisticated cyber threats. They use advanced strategies to enhance the cybersecurity posture of organizations by identifying and neutralizing threats in real-time, ensuring minimal damage and downtime.ATP is integral in safeguarding digital environments against evolving cyber threats. Leveraging deep packet inspection, behavioral analysis, and machine learning, ATP solutions provide comprehensive...
My main use case for Red Canary is that a Red Canary analyst monitors our logs, and if they see any abnormality, they create a ticket that we use to analyze the situation. We assign that ticket and analyze it to ensure we have all the details needed. We use other tools to investigate, but we mainly rely on the evidence from Red Canary, and we can also use the isolate feature from Red Canary. There are threat reports and agents, and in our environment, we have endpoints and identity as well. A recent situation where I used Red Canary to analyze a ticket involved an employee from the US who logged in from the UK, a country he had never visited before. Red Canary's analyst assumed that account was compromised, but after analyzing using our other tools, it seemed the login was legitimate. The user confirmed he had traveled to the UK and used one of our company phones to log into the account to check emails, so the alert triggered was a true positive but a legitimate anomaly.
My main use case for Red Canary is to ensure I can sleep at night by getting 24/7 coverage by a capable team to investigate any alerts for the systems that we have in place to ensure we don't have any security or suspicious activity. I can give you a specific example of a situation where Red Canary helped me out and made a difference: we've had more than a few instances where a user clicked on a phishing link, invoking connections to hostile sites. Through alerts in Defender, the Red Canary team identified, confirmed, and investigated the threat before they reset the user's credentials and contacted us to work with the user to resolve the situation. I have at least one other instance where Red Canary investigated an alert and continued doing additional investigations of logging and activity from that user and their systems around that proximity to confirm that there was no further suspicious activity.
We use Red Canary ( /products/red-canary-reviews ) to monitor incoming and outgoing traffic. For example, when we receive an alert that data from our internal IP address to an external IP address has been transferred, we investigate using a Palo Alto firewall.
My company uses Red Canary MDR to simulate MITRE ATT&CK, like spearphishing and updating domain names.
We use the solution's MDR service to monitor our Microsoft 365 environment, including Defender Endpoint.
We use Red Canary MDR for threat protection.
We mainly used Red Canary MDR for detecting and containing suspicious or malicious behavior on an endpoint, whether it's a suspicious act that a hacker might be conducting or actual malware. We are using Red Canary MDR with Carbon Black. Carbon Black supports different EDRs.
We started using Red Canary MDR because we had malware issues within our company.