BlackBerry Optics (CylanceOPTICS) vs. VMware Carbon Black EDR

You can set rules based on specific scenarios to run on machines. For example, you can use this to enable or disable machine learning to block or allow things that users regularly use. You can also log specific attacks on machines (for research later).

Incentivized

We are able to check if any phishing link was visited by the user or not. To check for the whether any file is executed on the machine or not. To check on which port connections are being made by the machine. To create custom watchlist for alert to be investigated by an analyst. To check every process executed in the machine for a specified range.

Incentivized

• Maps out solid template frameworks.
• Makes reporting to executives easy to compile and understand.

Incentivized

• Process tree view of endpoint activity
• Ability to pull files from host
• Threat Intelligence integration
• Isolate a host

Incentivized

• No major complaints! Love everything about the service.

Incentivized

• Number of false positive which are triggered due to threat feeds are sometimes more needs to be fine tuned by the client.
• In very rare scenarios processes are not captured properly.

Incentivized

I haven’t seen that there is much support for it. It seems like a lot of trial and error is/will be involved.

Incentivized

We use Cylance in conjunction with two other products. We have ArcticWolf for monitoring the machines at an even finer detail than Cylance (they can pick up things that can be missed). We also use Cisco Umbrella to block potentially malicious DNS queries. The combination of these three products helps us feel much more secure than if we had just one.

Incentivized

CB Response allows for a better view of what happened on the endpoint and provides more functionality out of the box then the FireEye Endpoint Security Product. CB Response allows you to basically have a remote connection into the CLI of an endpoint. This allows you to view the file system, run programs/scripts on the host, etc. FireEye Endpoint Security does not have this functionality.

Incentivized

• Addresses known gaps easily.
• Quick to implement.

Incentivized

• It is helping to protect us from potential loss of revenue that would be caused by malware or a compromised account.
• It took some time in deploying in the environment , but that time is much worth it because of the results we are getting now.
• It helps in hunting, which help us check and protect our environment from any cyber attacks.

Incentivized