Cybereason Defense Platform vs. Mandiant Advantage Threat Intelligence

I'd recommend Cybereason due to it's efficacy, low TCO, low false/positive rate. The product was easy to implement and maintain. One of the major advantages of using Cybereason is that it requires minimal training for level 1 users to use the tool.

Incentivized

Mandiant Advantage Threat Intelligence is well suited to data enrichment tasks and surfacing additional potential indicators of compromise based on observables found in an environment. Difficulties arise if the given data is classified in multiple platform modules, each requiring a different subscription. When tracking an indicator of compromise and wanting to see what actors it relates to and further understand the actor, you often end up with one side of the data or the other. IOCs with little campaign context or actor details with no tactical data.

Incentivized

• EDR
• Forensics
• Mitigation
• Response

Incentivized

• The organization of finished Threat Intelligence reports is a huge plus. Mandiant Advantage has broken up their delivery of Intel in a way that makes it seamless to access the things analysts are interested in. Whether it is a particular adversary, vulnerability or malware family, executing searches on any of the categories provided is intuitive and provides a great deal of info in the search results.
• Transparency in Intel sources, risk scoring and assessments is something Mandiant Advantage does very well. When Mandiant is not the source of the investigations or has not reached a definitive conclusion from their research, they are transparent in these gaps and they avoid biases at all costs in their reporting.
• Mandiant Advantage does a great job with flexibility in delivery of Threat Intelligence that makes sense to your company and the things you care about. Through dashboard customizations, it makes displaying the high priority Intelligence an easy task.

Incentivized

• Slow support
• Bugs on their interface
• Log extraction

Incentivized

• It is difficult to customize the platform
• There are different platforms running at the same time for similar purposes (Legacy, Advantage...)

Incentivized

Mandiant Advantage Threat Intelligence has a very usable platform, with well-differentiated sections for the analyst, as well as the possibility of cross-searching to obtain the desired results. All this is presented with an interface that is easy on the eye and not very messy, which increases productivity and the speed with which work is done.

Incentivized

Cybereason provides superior protection than either Microsoft or CrowdStrike and a better TCO. We receive less false positives than with Microsoft Defender and Cybereason is easier for level 1 users to use.

Incentivized

If you want threat intel coming into your EDR, Email gateway, and IPS, this is the most cost-effective solution. The others can only pump into your SIEM and rely on monitoring and detection. The former goes into active defense, aka active blocking.

Incentivized

• Helps on threat hunting
• MalOps is very good
• When we face a bug, it takes too much time for them to respond

Incentivized

• Improved incident response time
• Specific investigations that have reduced the attack surface
• Technical reports on threats not controlled by the bank's local team

Incentivized