Elastic Security vs. Microsoft Defender for Endpoint

I believe Endgame is well suited to organizations that have their own Cybersecurity department. Its not well suited for organizations that don't have a Cybersecurity department.

Incentivized

It's well-suited if you're already a Microsoft shop, particularly if there are budgeting concerns or it's a smaller operation where you might not have the finances to have a more diverse toolset. Falling back on something built-in because you're already a Microsoft customer is really helpful. Areas where I would say it's less appropriate are if you're not already a Microsoft customer. If you're a Google shop, then maybe it doesn't make the most sense. And then I'd say if you have large budgets, a wide diversity of systems, or a very large footprint, then having something ancillary, or at least another tool, can be impactful as far as making sure you have better visibility.

Incentivized

• Identify 0-day malware.
• Provides a few forensic details on endpoints.
• Very easy to administer.

Incentivized

• The big thing for us is on endpoint, it kind of integrates with everything else that we already have because we use Microsoft completely. And so that helps us with being able to integrate, and send things over to Azure Sentinel as we need to as well.

Incentivized

• I would love that it provided more memory analysis details.
• Being able to edit sensor profiles after creating them.
• I would love it if it provided more automation features.

Incentivized

• Differently. The biggest thing is that if there is a particular update to it that, for whatever reason, is incompatible with, like, an EHR or some software that we have, there is no easy way to roll back. There's not just like a one click rollback or anything like that. So we have to get in and do that. We've actually written a tool ourselves to manage that, so that's something that's missing.

Incentivized

Cost add-ons for Security features is nickel and diming the process to keep pace with cybercrime. Limited Education budgets require us to be more pro-active in finding cost-effective measures to protect our devices, staff and students. Defender is a strong, well-featured product that is pricing itself out of the education market

Incentivized

It's fairly good whenever you talk about leveraging it, but your staff just has to go read the tech articles. Microsoft does a great job of producing Microsoft technical articles. And so if you can go out there and take the time to read them, you will learn how to do it. It's just not intuitive from the screen if you're just kind of going through it for the first time.

Incentivized

Microsoft Defender for Endpoint chugs along just fine no matter what we throw at it and what systems it's running on. It doesn't take up a lot of resources either, so that's welcomed.

Incentivized

Microsoft Defender for Endpoint is easy on memory and resources on clients.

Incentivized

Even though their support is good, I think there are some areas where they need to provide more thorough solutions to issues, some of their solutions are pretty basic and have already been tried.

Incentivized

The first time I tried to onboard my macOS endpoints to MDE I struggled for quite a bit. I had to reach out to Microsoft's MDE support team. The tech was very helpful in walking me through the steps during a screen share session

Incentivized

Deployment was handled by our team here and everything went pretty smoothly. We did have a few hiccups in our test group, but that only took a bit to get ironed out.

Incentivized

Endgame is based on the MITRE framework which has proven to be a successful framework to identify various attack patterns that attackers use. Also, compared to the others it's easier to administer and manage.

Incentivized

I've used Sophos, Bitdefender, SentinelOne, and, of course, Microsoft Defender for Endpoint. We chose this at the time because we were such a Microsoft shop that it just seemed to integrate well with all the other things that we had set up with Microsoft.

Incentivized

Microsoft Defender for Endpoint is easily scaled from small orgs to giant enterprises.

Incentivized

• Being able to identify threats we couldn't identify before.
• Easier management of endpoints.
• Being able to immediately isolate endpoints remotely that have high severity threats.

Incentivized

• I'd probably say improved security outcomes and reduced risks. Vulnerability management has been crazy over these past few years just because of the amount of vulnerabilities that are getting discovered and reported. But Microsoft Defender for Endpoint has given us great visibility around that, even though it's a lot. And from that data, we have used it to help fix vulnerabilities, work with our systems team, and work with the appropriate teams to get those vulnerabilities resolved.

Incentivized