Anomali ThreatStream vs. Webroot Endpoint Protection

Anomali ThreatStream is excellent in scenarios where we deliver Managed Security Services to customers. It offers exhaustive volumes of information in the form of threat bulletins, IOCs, Threat Actor profiling, and details related to campaigns in the wild which can be used to a great extent by MSSPs. For an enterprise SOC, I believe it is a little less suited purely because of the pricing aspect as it is slightly towards the expensive side of the spectrum.

Incentivized

The software tends to do a good job of basic protection but is not the best for larger clients and is not as powerful as some others offered on the market today. The support is not the best either, have had a hard time getting assistance in the past trying to resolve issues.

Incentivized

• Indicators of Compromise
• Signatures
• Community Sharing

Incentivized

• It is very light weight and does not tax the computers resources
• Has a quick scan and does not take forevere when scanning
• It's central management on the web makes it easy to use and gives tons of control for Admins

Incentivized

• The user interface, perhaps there is some room for improvement although it is good already.
• Confidence assigning process for IOCs needs to be more robust and transparent.
• While integration with SIEM solutions is a cakewalk, there is definitely added value if SIGMA rule conversion and YARA rule creation are provided from the platform.

Incentivized

• There are several configuration options for both end-point and DNS protection. Would like a more simple way to understand and validate settings.
• Support is heavily video or FAQ based although you can submit a Support Ticket. Would like more availability to an actual support engineer.
• Overtime you can forget how to change setting - a refresher course would be nice, especially as new features are added to the solution.

Incentivized

It has proven successful so far in our environment for controlling malware/virus outbreaks.

Incentivized

Webroot Endpoint Protection has been great for us, as its simple, cloud-based management console allows us to quickly deploy easily monitor all of our endpoints. However, it could improve by offering more customizable reporting options for deeper insights into security events and the interface could also use some updating, as it feels a bit dated.

Incentivized

Support has been reliable up to this point. A request can easily be generated via the console and support responding in a reasonable time. We have not had any major issues other than the basic agents not communicating with the console and the like.

Incentivized

I had some difficulties with remote users. I ended up needing to open a remote tech support session and finish the process. Other than a few speed bumps, I was impressed with the engineering of the install. Because of time differences, I was done installing in two days. The cost, per license, could be less.

Incentivized

Many of the products that can be used to be ingested into a security event management software can be cumbersome with threat streamThere are many opportunities to continue fine-tuning the environment and providing great context in regards to threat research. When compared to other products threat stream stands out from usability and features.

Incentivized

Webroot is good in a way that it is an all encompassing solution one stop shop for protecting endpoints but it needs to be managed and licensed. Some users do not need constant protection or need to have it on their machines in where the combination of Field Effect and Malwarebytes is more effective.

Incentivized

• We have seen a positive ROI as the security monitoring is taken to the next level when it is augmented with threat intel data that Anomali provides.
• Our customers are very satisfied with the periodic threat reports that we send, which are created using Anomali ThreatStream.
• The overall business objectives are met as Threat Intel is one of the most important pillars when it comes to providing security services, and we use Anomali ThreatStream extensively for that.

Incentivized

• The DNS filtering allows for a very granular configuration of endpoints
• The cost to benefit ratio is good. It is not a real EDR player yet, but the development looks promising
• Its best feature is integration with our MSP software, providing actionable tickets.

Incentivized