Likelihood to Recommend
As a SIEM tool for investigations, Exabeam is the best in class. The AI assigns numeric values to observed logs them presents high scores to the analyst in a simple dashboard. We can see what is a real threat and ignore so many false positives. Exabeam is the best SIEM was used from an alert fatigue perspective. The simple interface allows other teams not just InfoSec to utilize the tool; helpdesk for asset diagnoses, HR for staffing questions, etc.
Read full review
Mandiant Advantage Threat Intelligence is well suited to data enrichment tasks and surfacing additional potential indicators of compromise based on observables found in an environment. Difficulties arise if the given data is classified in multiple platform modules, each requiring a different subscription. When tracking an indicator of compromise and wanting to see what actors it relates to and further understand the actor, you often end up with one side of the data or the other. IOCs with little campaign context or actor details with no tactical data.
Read full review Pros Fast search times, unlike other competing solutions. The ability for engineers to obtain access to the command line interface for troubleshooting, at least for on-premise deployments. License is suitable for organisations with lots of logs to ingest. Hardware required for on premise deployments is well supported. Read full review The organization of finished Threat Intelligence reports is a huge plus. Mandiant Advantage has broken up their delivery of Intel in a way that makes it seamless to access the things analysts are interested in. Whether it is a particular adversary, vulnerability or malware family, executing searches on any of the categories provided is intuitive and provides a great deal of info in the search results. Transparency in Intel sources, risk scoring and assessments is something Mandiant Advantage does very well. When Mandiant is not the source of the investigations or has not reached a definitive conclusion from their research, they are transparent in these gaps and they avoid biases at all costs in their reporting. Mandiant Advantage does a great job with flexibility in delivery of Threat Intelligence that makes sense to your company and the things you care about. Through dashboard customizations, it makes displaying the high priority Intelligence an easy task. Read full review Cons More and better drop-down menus, some items in threat hunter require you know subsets. Less dashboards, combine AA and DL without having separate logins. More complete playbooks are already built out. You have the structure set up for templates like malware and phishing, go further and completely build them out from start to finish, most companies would just use them and not personalize their configurations. Quarterly health checkup diagnostics of systems sent out to users. Read full review It is difficult to customize the platform There are different platforms running at the same time for similar purposes (Legacy, Advantage...) Read full review Usability
Exabeam is very good at processing lots of logs without excessive licensing costs. It has a professional support team that's very quick to resolve any issues and provides custom parsers quickly and enables our analysts to search vast data sets without having to wait long for results to be returned. The product is getting more mature with new features every major release.
Read full review
Mandiant Advantage Threat Intelligence has a very usable platform, with well-differentiated sections for the analyst, as well as the possibility of cross-searching to obtain the desired results. All this is presented with an interface that is easy on the eye and not very messy, which increases productivity and the speed with which work is done.
Read full review Support Rating
Exabeam Fusion has so many diffferent out reach meetings, webinars, community virtual coffees, and events that you can always stay abreast of what if happening and get new ideas for use cases. Their support actually answers their phones and can respond in chat instantly. With our cloud deployment Exabeam support teams can instantly see our systems and help us.
Read full review Alternatives Considered
If you want threat intel coming into your EDR, Email gateway, and IPS, this is the most cost-effective solution. The others can only pump into your SIEM and rely on monitoring and detection. The former goes into active defense, aka active blocking.
Read full review Return on Investment Reduced time to triage alerts. Reduced number of alerts which need escalation to senior tiers. The ability for analysts to quickly run playbooks for additional information and enrichment. Ability to retain data for longer periods for forensics purposes. Improved search performance compared with other SIEM solutions. Read full review Improved incident response time Specific investigations that have reduced the attack surface Technical reports on threats not controlled by the bank's local team Read full review ScreenShots Mandiant Advantage Threat Intelligence Screenshots