Elastic Security vs. Trellix Helix

I believe Endgame is well suited to organizations that have their own Cybersecurity department. Its not well suited for organizations that don't have a Cybersecurity department.

Incentivized

Great for organizations that are considering improving their operational security by utilizing their threats intelligence capabilities. It offers a great collection and analysis of security events and provides solutions to solve them. When considering a solution that is secure and can provide very extensive visualization of your environment for threats.

• Identify 0-day malware.
• Provides a few forensic details on endpoints.
• Very easy to administer.

Incentivized

• Single location for all security event management
• Detect advanced threats
• Provide audit artifacts to ensure compliance

Incentivized

• I would love that it provided more memory analysis details.
• Being able to edit sensor profiles after creating them.
• I would love it if it provided more automation features.

Incentivized

• Additional integration points (API cloud integrations).

Incentivized

Even though their support is good, I think there are some areas where they need to provide more thorough solutions to issues, some of their solutions are pretty basic and have already been tried.

Incentivized

We've been fairly happy with FireEye Helix support overall. Most issues are resolved the same day the case is opened.

Incentivized

Endgame is based on the MITRE framework which has proven to be a successful framework to identify various attack patterns that attackers use. Also, compared to the others it's easier to administer and manage.

Incentivized

It offers extensive visibility thus easy detection of threats and easy mitigation practices. Utilization of its threats intelligence capabilities thus early detection of incidents and maximization of security investments. Offers great integration of cloud resources with existing security tools thus ensuring seamless performance and all-time security for the organizational resources.

• Being able to identify threats we couldn't identify before.
• Easier management of endpoints.
• Being able to immediately isolate endpoints remotely that have high severity threats.

Incentivized

• Optimization of your security investments.
• Operations are seamless and better with easy integrations that enhance performance.
• Efficiency in running of incidences with enhanced case management for all its alerts.