Alert Logic Managed Detection and Response vs. OpenText EnCase Endpoint Security

This is pretty good AV product - lightweight, easy to install, and easy on system resources. It will take some getting used to on the end user side, it doesn't scan in a traditional way, and it does not have a taskbar icon so it hard to know if it's working or installed. My only complaint would be the false positives which I know every AV system has, but the problem with Barkly is that it alerts the users with a message (which they freak out about) and it alerts IT with an email. Again, not a major issue, but it can be annoying until it is overridden. The override process is super easy though, so its again, not a big deal.

Incentivized

It is more suited to environments that have a large internal user base since there will be more incidents that require forensic analysis. It will be less suited for environments that have a small internal user base due to the fact that there would be fewer incidents that require forensic analysis, but it really depends on the industry that a small internal user base is a part of.

Incentivized

• Customer Service. Usually, I'd put the technical details up front, and they're good with that too. But the service from pre-sales all the way through onboarding and continued account management is top tier. Our onboarding schedule got messed up, partly because of us, but that was rather minor. I always get prompt replies to any tickets, and they've even reached out to discuss my feature requests. When it comes to security, it's critical to have a responsive team, and they've got it.
• Detection seems good. It's hard to quantify exactly, but it seems that they always detect the bad actors. And when we get an alert, they include a bunch of details so we know what kind of scan they're trying to do, how far they got, etc. You can't prevent everyone from doing a scan on your IP, but it gives you a really good idea of where your soft spots might be. And if you're getting those low-level alerts, it's a reminder that it's there and working if you have a major event too.
• Very easy setup. This goes back to their customer support to some extent, as they walk you through all the steps required. But it's also about their technical solution, it's not so overly complex that it's fragile, nor does it take a great deal of time to deploy. And it's been zero effort to maintain since then.

Incentivized

• Functionality meets minimal requirements, since it performs forensic investigations as advertised.

Incentivized

• The interface is a little lacking from a search perspective but its not really meant for us to have to do the work

Incentivized

• Their UI definitely needs to be more user-friendly, right now it is very cumbersome to run and view investigations.
• Authentication mechanism should be a simple username/password, not certificate-based which is difficult to manage.
• Needs better support documentation for the product, it is difficult to find solutions to issues that we run into.

Incentivized

Because support is non-existent whenever you have a functionality issue using the product. Also since the UI is so cumbersome to use we could use as much support as possible. Whenever we ask for support we are told to take the training which costs us more money. I believe that support should be easily accessible and affordable for the client

Incentivized

I was using Alert Logic Insight for myself to improve my skills and ability to it. My organization was not happy using our previous website security program so I recommended for them to use this software. It has been more than 1 year and still, they are using this program without having any problem so far.

Incentivized

The other forensic tool that is a direct competitor to EnCase and wasn't listed above is the Forensic Toolkit or FTK. I believe that FTK is a better tool overall simply because it is easier to manage and use when it comes to investigations. Unfortunately, I wasn't part of the decision process and EnCase was the tool selected, otherwise, I would have recommended FTK.

Incentivized

• Return on Investment is measured in how protected our reputation is and Alert Logic contributes to this is a large way.
• Alert Logic provides excellent information security assurance to the business and allows us to feel more proactive.

Incentivized

• One negative impact would be that since the UI is cumbersome to use we would need to spend more money on training which is not always feasible.
• Another negative impact would be that since there is not much support available this slows down investigations due to finding out how to troubleshoot and fix functionality issues.
• One positive impact would be that since it meets minimal requirements when it comes to forensic analysis it gives us visibility on any malicious activity occurring on a user's endpoint.

Incentivized