Cisco Secure Endpoint (formerly Cisco AMP) vs Palo Alto Networks Cortex XDR (Traps)

• Identifies malware, malicious processes/services and other events well
• Great automated actions features such as host isolation
• Detailed threat visibility such as file trajectory
• Integration with other Cisco suite of security products
• Great value
• Low false positive rate
• Lightweight agent
• Variety of reporting
• Stable agent

Read full review

• Direct Access to devices via Live Terminal which provides operations with scripting, triage, and preservation of artifacts.
• Behavioral Indicators of Compromise which provides alerts on events regarding groups of hosts and their signatures.
• Querying complex data sets involving a variety of devices for network connections, hashes, DNS, etc.

Read full review

• Event search function. The searching is very limited and allows for poor filtering choices.
• Slowness. The web GUI is far slower than most Cisco products.
• Sync issues. When attempting to move a device from one group to another or start isolation on a device, there is a sizable delay in communication with the device that can cause operations to fail.

Read full review

• Traps doesn't seem to function as a traditional A/V very well, so it's better as another layer to your endpoint protection
• Traps can cause issues with some legacy or custom programs, so exceptions may have to be made
• Traps falsely identifies things as malicious at times, this is not often though

Read full review

• AMP has been able to catch some serious infections and stop them from doing huge damage in our environment.
• The overall cost of AMP vs the cost of not having this protection and getting hit with malware, or other nefarious damage to your environment is well worth the money.

Read full review

• After putting Palo Alto Networks Cortex XDR on a user's system, users came back with a positive response that there are no performance issues now.
• We are able to track and control granular suspicious and malicious activities.
• Web controls are missing, which if they would have been there would have been very helpful.

Read full review