Carbon Black Endpoint vs. SUSE Manager

Cb Defense has been working very well in our organization. It is giving us much better insight into the applications that people are running on their systems (without authorization). This software is also great because it provides visibility into systems that are remote (off the network but still have Internet access). The out of band feature is great to help ensure that the systems are protected even when a user is traveling.

Incentivized

In our specific use case, SUSE Manager is extremely useful. We're having a large landscape that is divided into intake, development, quality and production with a couple of different SUSE flavours that need to be automatically rolled out, configured, patched and maintained, everything from up to date repositories that are cloned on a daily basis straight from SUSE.

Incentivized

• History of Process Execution, really anything that happens in the system is easily seen within the Dashboard. I can determine if a bad actor has infected the system, be it malware, backdoor, rootkit, Trojan, then from that point, I can put the system into Quarantine.
• Being able to quarantine the system from the Dashboard. With these type of tools, pulling the power and running a hard drive image is not needed. Put the system in quarantine, start the analysis. A year ago, the network engineer might move the system into a VLAN that has no access to anything, except the system performing the remote analysis... Now I do not have to rely on anyone to move a system, power it down, pull the drive, or image the drive. I can just start the analysis right from my workstation.
• The Live Response, again goes hand in hand with the quarantine feature.
• By now, I am sure you see a process. Its simple, and easy and all done from a cloud-based console, called the dashboard. .. deploy the agent, create the policy, and active live response, set up email alerts, and monitor your endpoints... you are now ready to perform a triage in the event of an infection. We have step 1, step 2, step 3... but, just remember, things do happen, nothing is perfect, but this product has its advantages.

Incentivized

• Manages patch levels for most Linux OS by: date, group, cloud or custom channels
• Uses a lite version of Salt to run commands or scripts on any numbers of servers at once.
• Allows the joining of groups inside SUSE Manager to quickly access or work with servers so grouped.

• Policy management can be cumbersome. It is simple to set up a single policy but you have no way to apply the rules to multiple groups. If you need to set up the same rule to multiple policies, you need to type it over again.
• Agent updates can be very slow to deploy. We use a mix of rolling out updates via the web console and our management appliance. It can take several weeks to update all agents.
• We can be confused on why a rule will apply to a file. Sometimes something is blocked but we don't understand why.

Incentivized

• The cloning of patches when using the content lifecycle module in a multi-environment landscape with many SLES flavours is a bit cumbersome.
• More premade saltstate for default applications are always nice to have.
• Upgrading SUMA could be easier, especially when a Postgres upgrade is also required.

Incentivized

I am expanding the use of SUSE Manager throughout our organization and can't imagine going back to the "wild wild west" we had before.

The console of the product is very easy to use. It provides great detailed information about all aspects of things occurring on the endpoint. It was easy to deploy and set up. The centralized cloud-based interface has made it easy to add two domains and manage them under a single pane with multiple admins. The only reason I wouldn't give it a higher score is a little bit of lag between updated info from the clients and also the lack of accountability in the deployment process. You set the deployment up for multiple machines and can't easily see if it was successful and/or it takes a while to see if it succeeded or failed.

Incentivized

The gui is extremely user friendly. The installation and configuration does have a learning curve, it takes a while to set everything up. But once you're passed this initial learning curve, everything is very intuitive. If you want extra automation, there's an api (eventough i personally find the documentation of the api could be ordered better). I gave this product a 9 because of the initial learning curve and the api documentation, but for the rest it suits my needs perfectly.

Incentivized

First, I need to disclose that our support is provided by SecureWorks. We purchased CB Defense from them, and they provide 24x7 monitoring and notification services for the solution and its deployment on our endpoints. To date, we are very pleased with this arrangement

Incentivized

SUSE Manager provided a top-tier support person on site to us for two days to help integration. We did all the standard stuff they help with before he arrived. We were able to use him to get all the tricky stuff identified and solved in the short time we had. Had they sent us a lower-tier guy, it would have been a waste. I was impressed they sent such knowledgeable person.

Cb is cloud-based and has a more advanced policy management. It also has better forensics information. Cost was similar, but Cb added cost savings in terms of IT management resources. We also have the ability to talk directly with engineers and have input on feature updates.

Incentivized

The other competitors also have a good platform and service, but we went with SUSE due to cost. The price was best and we needed to keep under a certain budget. The functionality was perfect for what we needed so we took the step forward. This allows us to manage our Linux environment within the manager and update or deploy specific tasks to each as needed.

Incentivized

• Cb Defense has had a positive impact on the business objectives since we've been able to check off "advanced threat prevention".

Incentivized

• Manages patch levels for most Linux OS by: date, group, cloud or custom channels
• Make it easy to audit our own infrastructure.
• Allows the joining of groups inside SUSE Manager to quickly access or work with servers so grouped.
• 24/7 support team.
• Automatic deployment.

Incentivized