Miriam Tover - PeerSpot reviewer
Service Delivery Manager at PeerSpot (formerly IT Central Station)
  • 0
  • 73

What needs improvement with Carbon Black CB Defense?

Please share with the community what you think needs improvement with Carbon Black CB Defense.

What are its weaknesses? What would you like to see changed in a future version?

PeerSpot user
30 Answers
Senior Director, Information Technology at C.E. Niehoff & Co.
Real User
Top 20
May 11, 2022

Currently, it's hard to comment on areas for improvement, because I haven't used Carbon Black CB Defense long enough. What was rolled out to my company are mixed versions of Carbon Black CB Defense, so what I'd like to see in the next release is more synchronization, where it can detect the endpoint that's running an old version and suggest updates. That's the only thing I can think of right now.

Search for a product comparison
RizwanAlam - PeerSpot reviewer
AVP - Information Security Governence & Risk Management at Allied Bank Limited
Real User
Top 20
Apr 27, 2022

There is no option for the solution to block automatically based on behavior. First, the solution needs a lot of time to record all the behaviors. Then, we manually have to create a behavior analysis rule to detect any malicious activity. The solution would be improved and be more effective if there was a way for this process to be done automatically.

Lead IT Security Analyst at a government with 501-1,000 employees
Real User
Top 20
Mar 7, 2022

There could be more knowledge. I think they made a mistake when they took away the Check Point integration, because it provides more automation and also more threat intelligence. Maybe you didn't see something within Carbon Black's sphere of what it knows, within their product line or their threat cloud or whatever they use for their intelligence. Maybe it didn't see anything of the files that it knows about, but what about somebody else's? And what about kicking into another product that does those kinds of things like sandboxing? I don't know why they would take that away. That doesn't make sense to me because they need to expand on that. The more they expand on that, the more confidence you have as a security guy. You have more confidence that that file is clean, and there's nothing bad about it. Bringing back the integration with Check Point would be a good start. This product is being used extensively in our organization. I'm actually looking for a replacement because of the fact that we lost that integration. That's really crucial, honestly. Otherwise, it becomes much more manpower-intensive. I need to spend more man-hours going through it instead of using automations. I prefer to set up things so my team doesn't have to spend a huge amount of time running down rabbit trails all the time. The more we can automate and still be secure about it, that is what we try to do. There are no additional features I would like to see added. I know they already have a cloud offering as well. You can manage things through their cloud for people that are always on-site. We mostly just use it for our own managed devices. We didn't really put it on. We never planned and don't plan to put it on or make it available to a BYOD kind of thing. This is all company-managed devices. It just made more sense for us to do it internally than putting it in the cloud. But we could have done either one, I suppose. But since we started out inside, we just kept it that way. It was just easier.

IT Manager at a financial services firm with 51-200 employees
Real User
Top 5
Feb 20, 2022

This product should be cheaper.

IT Infrastructure and Security Manager at a paper AND forest products with 1,001-5,000 employees
Real User
Top 20
Feb 16, 2022

The node management could be much better. The one thing that they cannot do very easily is change the tenant from a backend. As an example, assets were sold from a company called Rayonier Advanced Materials and went to GreenFirst, which became GreenFirst as a startup. We had a tenant where all the machines were registered to the cloud. That is the tenant that was there for Rayonier. It is very hard for them to make changes to the tenants, such as rename or anything like that. What they really would push you to do is, "Your tenant is going to be under your company name. You have to uninstall all the agents and reinstall them again." Making changes at a tenant-level would be a welcome feature to allow divestitures and things like that. They can do some of these things, but they're not very user friendly or easily done. They basically tell you to do the hard lifting yourself. For example, they basically kept pushing me and saying, "Uninstall your antivirus on about 500 machines and reinstall it with the new tenant information." I would say "No, everything is a tenant. Rename me the tenant." I would like to see the GUI improved and easier troubleshooting. One thing they did that makes it easier in troubleshooting versus the older versions of the software is that now you can actually drill down to see the parent process and go all the way down. In CrowdStrike, they have a timeline where they actually build the whole scenario as to what happened. It's like a playback. It's almost like a movie. You play back and it says, "Okay, this process ran," and then it shows what it caused and everything. You can see all that and if there are any screen outputs it puts it on because CrowdStrike actually maintains some of those things. A playback feature would be very valuable.

IT Administrator at a manufacturing company with 501-1,000 employees
Real User
Top 5
Jan 24, 2022

I haven't run into anything that needs improvement. The website interface can be a little bit better, but it's still good as compared to most others.

Learn what your peers think about Carbon Black CB Defense. Get advice and tips from experienced pros sharing their opinions. Updated: November 2022.
653,584 professionals have used our research since 2012.
Gian Michele Roletto - PeerSpot reviewer
SOC Manager at Nais Srl
Real User
Top 5Leaderboard
Jan 5, 2022

I believe they could improve the new intelligence solution to monitor activity, in the network. They will most likely need to create or include a feature that checks the network.

Cyber Security Engineer at a tech services company with 201-500 employees
Real User
Top 5Leaderboard
Dec 15, 2021

Integration is difficult, but CB Defense is more powerful than others. It is difficult to implement but easy to pick up many detections.

Nadeem Syed - PeerSpot reviewer
CEO at Haniya Technologies
Real User
Top 5Leaderboard
Dec 9, 2021

Carbon Black does not have a big market in Pakistan right now. They are actually trying to penetrate the region right now. They don't have many customers. Even we are new to the Carbon Black as well, in that we knew about Carbon Black for a long time, however, as far as implementing it and giving it to our customers, we are still new to it. The pricing could be more reasonable.

IT Manager - System Administration at a pharma/biotech company with 501-1,000 employees
Real User
Top 20
Aug 20, 2021

The on-prem one was very problematic, especially version 7.2, which did not play nice with Symantec at all. The last upgrade of the client actually triggered a block to the networking, to our active directory domain controllers. There was a bug that we found was in Macs. It was triggering false positives as it wasn't able to figure out the right parent upon login. With the Carbon Black Cloud, we just got it two to three weeks ago. So far, I haven't seen any false positives. The cloud seems to be a much better product. With the on-prem one, the bug has been reported by the community in early January or February, something like that, at the beginning of the year, and it's still not addressed. They have released two versions since then, and yet neither of them addresses this specific issue. I need more time to explore the cloud deployment, as we've only had it for three weeks at this point.

IT Cybersecurity at a manufacturing company with 10,001+ employees
Real User
Jun 29, 2021

Sometimes the solution blocks items that were previously approved and we don't know why. It is sometimes hard when I attempt to investigate, to know the commands. It's not easy to do that. You need to upload the right information. Occasionally, when we get alerts, we don't get all the information we need, such as the computer's serial number. If I reveal an alert in a new window, I need to go back to the main link as it doesn't work. Sometimes we need to close the solution and then open it up again. Occasionally, we'll have issues with the latest version and they'll basically tell us that they will improve it in the next iteration. They need to work on their version release quality. It would be good to have more information about the devices. If you get an alert that a malicious file is on your computer, Carbon Black really doesn't give you the full picture. We also need to wait for the user who owns the computer to be online before we can investigate everything. It's hard when you are working across time zones.

Randy Lahti - PeerSpot reviewer
Founding Partner, Security Architect at ISS
Top 20
May 12, 2021

This solution could have greater granular control on how certain applications work. You are able to do the operation of allowing or disallow, or you can block unusual usage of an application, but they do not define it well. The PowerShell is being called in any way that the threat actor might use it versus an administrator. You are in a way taking this solutions' best guess at it or their understanding of it. They do not clearly tell you in technical terms how they make that determination. They should be more forthright about it, or if they can not tell us, they should just give us the control to make those selections. We are choosing it because at least we have that control where we do not have that same amount of control with other solutions like Cylance. However, they are still not telling us precisely what constitutes suspicious behavior, what actions, or what calls. It is a check box to say, lock if we have inappropriate use, or block if we have suspicious behavior. It would be helpful to tell us what that actually meant. In the future, I would like to see more granular control of PowerShell and more administrative tools.

Abbasi Poonawala - PeerSpot reviewer
Chief Enterprise Architect at Bank in KSA/JPMORGAN
Real User
Top 5Leaderboard
Feb 24, 2021

In the next release, it would help if we can get better control over containers. This will help secure the containers in multiple environments. For example, we need to secure the Kubernetes containers. Apart from admin user login to see containers processes running, developers & operate team users also should be seeing the container's processes running.

Senior Infrastructure and Security Engineer at a manufacturing company with 51-200 employees
Real User
Jan 23, 2021

It could be a bit complicated. You have to be very familiar with Carbon Black to understand what it is doing and why it is doing. I would like to have more explanations and simplification in the user interface. It would be good to get help and see more explanations. It should tell us that a software is blocked and the reason for it. It would be good to be able to build chains in terms of what caused what, what worked, and what caused an issue. We are now moving from Carbon Black to Cortex XDR. While choosing antivirus software, we were also looking at Carbon Black because it also has an antivirus package, and it is next-generation, but we were told that Carbon Black doesn't support firewalls. We have Palo Alto firewalls. We would have chosen this solution if it supported firewalls, in particular next-generation firewalls, but unfortunately, it doesn't. Therefore, we decided on Cortex XDR because it integrates with Palo Alto firewalls.

Cyber Security Consultant with 1,001-5,000 employees
Real User
Jan 16, 2021

I can't think of any feature that needs to be enhanced or reviewed at this time. Some of the features that I see as an end-user, unfortunately, I haven't been able to see from a project management standpoint. I'm not sure if we're actually taking advantage of all the available features. I don't know if it's because we haven't configured it yet, or we are not using it. I'm not sure as to the logic of how we've decided to customize it. We've only really used it since February and therefore there may be more to do on that front. That's why it's hard to say if something is missing or if we just aren't utilizing it.

Infrastructure and support manager at a healthcare company with 51-200 employees
Real User
Jan 11, 2021

The whitelisting system, and the concept of it, overall, is pretty decent. The problem with the whitelisting capability is that it's pretty archaic. Based on all the security roles and the release privilege, it could take time for an application to be whitelisted and approved for use. The Mac support needs improvement, as it had next to none. The biggest problem we had was the Mac support. It had very little, and my C-suite is almost exclusively Mac, as is my marketing and development department.

Security Engineer at a tech services company with 11-50 employees
Real User
Nov 20, 2020

The application control can be improved. It should also have an automatic update of the agents.

IT Infrastructure - Global Head at a comms service provider with 10,001+ employees
Real User
Nov 11, 2020

The solution needs better overall compatibility with other products.

Owner at a tech services company with 1-10 employees
Real User
Nov 11, 2020

Its compatibility can be improved. It did crash a server during deployment, which is not something that I want to happen. Its deployment should also be easier. The whole deployment cycle needs to be simplified. It is an enterprise solution, and to set it up right now, you have to be an expert.

Kostia Tkachov - PeerSpot reviewer
IT Security Solutions Engineer at Softprom
Real User
Nov 5, 2020

To improve the ability to connect also feeds of third resources (communities).

Information Security Consultant at a healthcare company with 10,001+ employees
Oct 11, 2020

The feature set for the firewall needs improvement. I am looking forward to learning more about the integration with VMware at the hypervisor layer.

Dhrubo Roy - PeerSpot reviewer
Threat and Vulnerability Engineer at Horizon Blue Cross Blue Shield of New Jersey
Real User
Jul 19, 2020

The EDR portion could be better. I'm not a big fan, but it works. The End Point Detection Response and the way it lays our processes with our endpoint and its detection engine, in the way that it detects the admin or alerts we based on a threat. I feel that they're a little behind on the market from my perspective. Overall, areas of improvement would be the EDR part, the detection, also the cloud console. If you're trying to write queries or something, it's very slow, just not robust. It's a cloud console so it should be fast. If I run a query and I press enter, if it took two seconds, it wouldn't give me a nice loading interface, because it's stuck. I would see an operating system most of the time. I feel like it should be faster. But as far as the price and everything, I think it's a good product.

Senior Security Consultant at a manufacturing company with 10,001+ employees
Real User
Oct 8, 2018

It is still evolving, as we see. We started using the version 3.0. We've been migrating and upgrading as well, laterally, until version 3.2. So, we have been seeing a lot of improvements in general in terms of bug fixes and in terms of what are the things that we had encountered. I think they can probably bring in because there is a little bit of a gap between the native Antivirus solutions like Symantec or McAfee. So, you really can't say whether an end user will not be able to judge whether it's a Malware-free software that they are downloading or not. In those cases, if you have an application and a device control feature, I think it would be of great help.

Assistant Technical Manager at a tech services company with 11-50 employees
Apr 23, 2020

When you view the triage, it will show you everything within a given time frame, and not only the attack that caused the alert, which is what I want to see. It shows you all the events during that time, and that can be quite confusing. If they could focus on the alert and the event that the user wants to see, that would be better. There is also room for improvement on the reporting side, because it doesn't have reports. Many of our customers would prefer some kind of exportable report, like a summary. Carbon Black should have this feature.

Imad Taha - PeerSpot reviewer
Group CIO at a construction company with 10,001+ employees
Real User
Apr 6, 2020

As far as I know, Carbon Defense has nothing that can be installed on mobile devices. It lacks a defense solution for mobile devices, especially mobile tablets. I would like to see support for mobile devices and the pricing should be less than the pricing for a normal workstation. Also, there is not much education for customers about Defense versus its other products. They promote Defense as enough, but then they say if you need more protection you can go for CB Response. I don't know whether it's a technology issue or a marketing issue, but they should teach the customer more. They tell you you are secure with Carbon Defense but then they recommend Carbon Protect. There is not a lot of education on this. I don't want to have an incident in the future and their answer will be, "Sorry, you did not buy Protect." Security is a continuous process. I can accept that it has more features, but don't tell me, "You are not protected because you did not buy the more expensive product." In addition, these other products should be add-ons, not separate products. And the cost for them should be much less for adding on because you are already a customer. Finally, we receive a lot of high alerts. There is no priority system, from one to 10, where 10 is very dangerous and one is something easy. There is no way for us to tell why this alert is similar to that one.

Mark Adams - PeerSpot reviewer
Senior Manager, IT Security and Compliance / CISO at Superior Energy Services, Inc.
Real User
Oct 30, 2019

This solution works well but needs lots of tuning and optimization.

RajaeAl Najjar - PeerSpot reviewer
Solutions Manager at Samir Group
Real User
Sep 29, 2019

The endpoint machines need improvement. The solution needs to be more effective for the end-user. It would be helpful to understand how to do some queries, but we’re still testing the solution right now, so everything is very new and we’re still learning the system.

Darrick Kristich - PeerSpot reviewer
Founder/CEO at Sedara
Apr 17, 2019

Symantec needs more investigative features out-of-the-box. Though, they are using the Advanced Threat Protection add-on to correct some of this. It is also not quite as feature-rich as some of the more advanced MDR platforms out there. Carbon Black needs to do a better job of proving their platform in the industry, and providing a bit more access to do industry testing with real world examples to help prove their platform. In additional, they have been actively porting over a lot of features from some of their other products, and they should continue to expand on that. Going forward, this will be extremely helpful.

Sr. Security Analyst, Enterprise Architecture and Security at Akamai Technologies
Real User
Oct 28, 2018

The UI interface needs improvement. The management needs further work in future versions.

Andre B. - PeerSpot reviewer
Executive Business Analyst & Advisor at EY
Real User
Oct 2, 2018

In some areas one of the big issues for me is responsiveness to issues that arise with the solution. There are some components that leave a bit to be desired and/or that are bugs, or that even if it's a feature update request. These kinds of things are not the fastest company to respond to those. We did have a bug that was persistent for it's now going on two months and it hasn't been fixed. That is one of the drawbacks. This is really impacting what we need to do with it. But, the bigger issue is the organizational responsiveness to clients. In addition, I think there should be a cloud gateway. It needs to move into a transitory space between our On-Premise and external where it does not have to be in two separate instances. It should marry the two. Also, it would be good to have them working in the containerization space, as well. To have a mechanism for securing cloud modules a bit better. This would be ideal. It would help encompass more of the broad range security so we do not have to couple this with other outside solutions.

Related Questions
Netanya Carmi - PeerSpot reviewer
Content Manager at PeerSpot (formerly IT Central Station)
Nov 24, 2021
Which is better and why?
See 1 answer
Jairo Willian Pereira - PeerSpot reviewer
Information Security Manager at a financial services firm with 5,001-10,000 employees
Nov 24, 2021
I don't know these 2 solutions but a very important point to consider is called Linux (or Macintosh - non-Windows platforms that must be inspected by the tool.
Netanya Carmi - PeerSpot reviewer
Content Manager at PeerSpot (formerly IT Central Station)
Nov 1, 2021
Which would you choose?
See 2 answers
Chief Information Security Officer at a construction company with 10,001+ employees
Oct 18, 2021
Neither, we have optimal results with Cynet.
Nov 1, 2021
Carbon Black offers two different levels of Endpoint Detection and Response. One is the VM Carbon Black Cloud Endpoint Standard (CB Defense), and the other is the Carbon Black Endpoint Detection and Response (EDR). We reviewed both and chose the CB Defense. CB Defense is a next-generation antivirus and endpoint security solution. It uses machine learning and behavioral analytics to monitor endpoint activity and discover malicious activity. Once CB Defense detects a threat, it efficiently blocks harmful apps. It not only prevents any known threats but also prevents suspicious applications from running. One of the advantages of CB Defense is that it protects multiple types of devices (desktops, laptops, and servers). It is a solution that works well for small and large organizations. We like the ease of use and visibility of the management portal. You can see the activity on all protected endpoints. Configuring policies is simple, too. The only downside of CB Defense is that you cannot scan individual files on the endpoint. Carbon Black Endpoint Detection and Response (EDR) is geared more to security operation center teams (SOC) with hybrid or on-premises environments. Unlike CB Defense, Carbon Black EDR stores endpoint activity data. This feature helps security analysts visualize the attack kill chain. Although focused on an on-premises environment, the platform uses the VMWare Carbon Black Cloud’s threat intelligence. CB Response enables security teams to investigate an endpoint for suspicious activity. An advantage is that you can perform different types of investigations. Other advantages include seeing the process tree view of the endpoint and isolating and pulling files from a host. We also liked that you can see a timeline of changes made to a system. The defensive abilities are not as advanced as CB Defense, though. Conclusion Both solutions protect endpoints with advanced features. CB Defense is more useful for organizations. CB EDR offers deeper investigation features so that it could be a better solution for SOCs.
Download Free Report
Download our free Carbon Black CB Defense Report and get advice and tips from experienced pros sharing their opinions. Updated: November 2022.
653,584 professionals have used our research since 2012.