The LevelBlue USM Anywhere XDR platform (replacing the former AlienVault USM) delivers threat detection, incident response, and compliance management.
$1,075
per month
Watchguard Endpoint Security
Score 8.8 out of 10
N/A
WatchGuard EPDR (formerly Panda Adaptive Defense 360) combines next-generation antivirus protection, endpoint detection and response (EDR), patch management, content filtering, email security, full disk encryption, and more, into one package. The platform touts a unique zero-trust security service that certifies the legitimacy and safety of all running applications thanks to a combination of automated, AI-driven processes and investigation services provided by a team of malware analysts.
At this point I'm saying a 4. While the marketing material make it appear to be easy to use and it was relatively easy to set up, as previously mentioned, each event description is based upon the individual asset making it nearly impossible for the administrator to be a SME for each asset. For example, if one of the assets reporting is a router, the administrator monitoring alerts would need to know what the various events are that can be triggered as an event for the particular router; however, if the asset is a workstation, the administrator would need to know the various events that are triggered for workstations.
I would absolutely recommend Watchguard Endpoint Security to a colleague - as there's only four of us on the team in the entire district. The additional client insights have been invaluable to us. We had, historically, been doing Windows updates A. whenever a device was turned in with issues, or B. each Summer during device turn in. We can now control those updates with this software - pushing Windows patches to necessarily clients with the push of a button. This has saved us COUNTLESS hours of driving or directing staff to update themselves (and then ignoring us). We do have a remote desktop client that we have utilized in the past, but updating during the day is cumbersome for teachers. Watchguard Endpoint Security has now given us more control over our devices - as well as better protection from threats as well.
AlienVault USM is simple and easy to deploy. Sensors can be deployed in as little as 15 minutes through the setup wizard.
The USM UI is easy to understand. I've trained multiple analysts who are able to perform their duties on their first day, in part because of USM Anywhere's ease of use.
Top-notch built-in compliance templates and reporting features.
Personally, I've wished I could purchase a service that would configure AV for my environment. I get a lot of traffic on a daily basis and I almost need to hire an analyst that just works on AV.
Some of the filters when looking for a specific alert aren't that easy to use.
EndPoint has an optional feature for automatic and remote software updates on endpoints, a handy option for keeping computers up-to-date and secure. However, it is not used to install new software but only to update it. We believe that this part is instrumental, but it is somewhat incomplete.
Another drawback is that some complementary functions to the antivirus, such as the one above, are optional and require a separate subscription.
The implementation of EndPoint requires some planning, especially the time required to harden and learn the system. This is not critical and is typical for this type of system, but it is necessary to plan it well.
The centralized logging and retention for PCI compliance was our main driver, and it is meeting that need. Otherwise there has been enough frustration with the lack of documentation and the need to customize through the CLI that I would be open to alternatives.
The ease of use, pricing, support, reliability, and quality of the product. Panda / WatchGuard products are highly rated, priced right and easy to maintain. All of this make it very easy to renew and purchase new licenses for us and our clients.
Once you are able to navigate the different panels, finding what you need is quite easily. Before getting used it it can be a bit of challenge . Each panel is quite well laid out and the filtering search capabilities are quite strong.
Easy and intuitive MSP management portal to manage all of your clients from a single pane of glass. Policies can be pushed down globally or individually based on needs. The client portal allows access to their tenant information and installs only which is nice if you are working with clients who might have an internal person or an IT team that also wants access to things to manage themself.
We do have issues with maintenance on the AlienVault USM as the disk fills up from time to time with other data sources. Sources for scanning logs and net flow data isn't calculated in regular disk maintenance and can easily fill up our disk if we do not keep an eye on it with some custom Nagios plugins. The system does properly trim logging data from logging sources properly.
The software is 100% managed on a cloud platform that can be managed via an account even if they are not present within the company network where the software is installed, I even always opened the control panel on the browser of my smartphone to monitor the situation.I have never experienced any abnormal software crashes
With the latest release of AlienVault USM overall performance has not been an issue. We have noticed single source events per second does not scale well with the overall system. 2,000eps on a vmware system with a single source produces delays of up to an hour for us. Pages, reporting and even raw log searches are rather quick though.
The only annoyance I complain, if we want to be picky, is the fact of the constant disconnections from the control panel.Every about 4 hours the account logs out even if I set the "remember this device" flag; having said that I have not noticed neither slowdowns nor conflicts with other software
The support we received from alienvault was excellent. They went above and beyond in making sure everything was working as it needed to be. They REALLY want their product implementation to be a success and our security goals be achieved. They are like a member of our security team.
I gave it a 10 because I compare it to air conditioning. I need it to work every day, 24/7. I need it to be reliable and not something that requires a ton of interaction from staff to make sure it works every day. In addition, I should be able to run other things at my house when the AC is on. Panda fits that description.
I did not have any experience with "in person" training directly. The free online classes offered for a half a day are based on the actual training offered. These little teasers are very good and well worth your time to learn a few quick and dirty ways of getting more information from your SIEM
It was very well organized and helpful in using the product to the fullest extent. The instructor allowed time for folks who were involved with managed services to receive tuning tips in order to better support their customers. In addition, the course materials were automatically updated when the new version came out.
The training was very helpful. It demonstrated how to configure the service for initial install, items to monitor, and how to set up for ongoing protection. Hands on training is more helpful but this is a good starting point
AlienVault USM was a very simple to implement and get up and running. We started with a trial version and had that up and going within an hour of receiving email instructions from the sales engineer. We never had to contact support to get the system up and going. It was extremely easy to convert over to a full license once we started with a paid version.
Implementation shouldn't present any problems in standard office environments. In environments with development teams, however, caution is needed. If zero trust is enabled, mechanisms must be in place to ensure that internal software isn't classified as a false positive (software certificate, exception folder, etc.)
Splunk's ES is a paid add-on on top of an already pricey product. Finding a MSSP that supports Splunk and isn't a 6 figure annual commitment seems unlikely. LogRhythm did not have a cloud-based solution when we were considering SIEMs. Fantastic product though and have a good MSSP base. Devo did not have a MSSP partner base when we looked. Their product is fantastic too. AlienVault USM has good partners to choose from as well as an affordable cloud model, that's why we chose it.
We prefer to maintain loyalty with a brand that really delivers what it promises. Our focus is to bring customers who have other solutions to Watchguard's base, however some companies have their own IT department and already work with other tools. Preferimos Fidelizar com uma marca que realmente entreg o que promente. Nosso foco é trazer os clientes que possuem outras soluções para base da Watchguard, contudo algumas empresas possuem departamento de TI próprio e já atuam com outras ferramentas.
The AlienVault USM is not very scalable. Some scalability can be achieved by installing additional sensors, but this only offers 500eps per sensor and is still overall limited by the installation type of VM or physical. We have also noticed the EPS (events per second) is rated overall and not towards a single source. A single source on a very healthy VMware partition tops out at 2,000eps for us, no matter how we configure it. Maybe this is a problem of the 5.2 release?
With the implementation of watchguard (at the beginning Panda Endpoint, but it is the same) I was able to insert in the control panel all the unauthorized software previously installed by colleagues without any authorization from the various department heads.Now any licensed software goes into lockdown and can be unlocked from the control panel
Once you hit the 150 asset mark, you have to jump to their unlimited license. There is no middle ground. We were only 10 or so assets above the 150 so we had to chose to either not monitor those assets or pay the price of the upgrade.
AlienVault brings all the information to one place which makes it much quicker to track down problems.
By committing to go all in on Watchguard Advanced EPDR across our whole client base, we maximized our price position - enabling us to offer the best endpoint security at a price better than what lesser competitive products cost.
Leveraging Watchguard Endpoint Security as part of our unified platform strategy provides better integrated security, managed through Watchguard's cloud architecture. This significantly reduces our cost to deploy, manage, and support our client's. Our improved security offering, better delivery, and stronger price position has helped us achieve 56% growth in our managed services business over the past 18-months.
Organizations that have disparate cyber security products often require specialists for each solution in their stack. Watchguard provides outstanding training resources that equip our entire technical staff - significantly improving our service delivery while lowering our overall cost of business.
