Carbon Black EDR vs. Kaspersky EDR Expert

We are able to check if any phishing link was visited by the user or not. To check for the whether any file is executed on the machine or not. To check on which port connections are being made by the machine. To create custom watchlist for alert to be investigated by an analyst. To check every process executed in the machine for a specified range.

Incentivized

Easy to learn, use and deploy. Kaspersky EDR Expert allows to automatically find unmanaged and rogue endpoints, remove previous agent from another vendor, install its agent, move endpoint to a group based on endpoint's characteristics, change security policies if for example endpoint is moved to another subnet or currently out-of-office, apply malware outbreak rules in case of attack

• Process tree view of endpoint activity
• Ability to pull files from host
• Threat Intelligence integration
• Isolate a host

Incentivized

• Identify and automatically respond to end-point security threats
• Protect end-point systems against a broad range of cyber attacks
• Reduce operational costs to support EDR services

Incentivized

• Number of false positive which are triggered due to threat feeds are sometimes more needs to be fine tuned by the client.
• In very rare scenarios processes are not captured properly.

Incentivized

• Linux-systems support on the same level like windows systems
• Untying from Kaspesky ATA
• AI add to ease the way of profiling the system (it requires 1 FTE to examine all the incidents on 10 000 hosts? too much)

Incentivized

I believe the Kaspersky EDR Expert systems represent significant cyber risks for government and commercial enterprise customers

Incentivized

CB Response allows for a better view of what happened on the endpoint and provides more functionality out of the box then the FireEye Endpoint Security Product. CB Response allows you to basically have a remote connection into the CLI of an endpoint. This allows you to view the file system, run programs/scripts on the host, etc. FireEye Endpoint Security does not have this functionality.

Incentivized

Overall, the suite of benefits and more reasonable cost per user/license to the organization were the key components affecting our decision-making.

Incentivized

• It is helping to protect us from potential loss of revenue that would be caused by malware or a compromised account.
• It took some time in deploying in the environment , but that time is much worth it because of the results we are getting now.
• It helps in hunting, which help us check and protect our environment from any cyber attacks.

Incentivized

• Automating response task on suspicious activity
• Improving IT specialists skills and IS specialists skills
• Increased visibility of what malware really do on endpoint