Microsoft 365 Defender combines SIEM and XDR capabilities for Microsoft 365 environments, encompassing threat detection, post-breach detection, automated investigation, and response for endpoints. Additionally, it protects cloud apps, emails and documents, and employee identities.
N/A
ThreatLocker
Score 9.4 out of 10
N/A
ThreatLocker Inc. is a security platform used to stop misuse and vulnerable software as well as control application elevation, storage and network traffic.
Microsoft Defender XDR is well suited for organizations already invested in the Microsoft Ecosystem - including Microsoft 365, Azure Ad and INTune. For example, in scenarios where you need to correlament the fishing attacks with the closing point behavior and identity agreement, Microsoft Defender XDR does a big task of sewing the timeline of a full attack simultaneously and even automatically removing. This hybrid function is also ideal for the environment, where safety visibility in distance tools, cloud apps and email is important. Microsoft Defender XDR provides centralized insight and response in all these domains without the requirement of many devices. However, it is less suitable in the atmosphere with diverse or non-microsoft infrastructure, such as an organization running a mixture of Linux server, Google work area or third-party EDR tools. Cross-platform support is still developing, and integration of the microsoft ecosystem often requires additional configurations or third-party connectors. For companies of that situation, Microsoft Defender XDR cannot give its full value from the XDR box.
Threatlocker does exactly as it advertises. I would recommend it to anyone seeking a comprehensive solution for managing software approvals. It is also very easy to use with an online support team, or Cyberheros, as they call it, that is very quick and responsive. The preset programs are also a nice touch, making deployment easy.
The software uses advanced AI and machine learning algorithms to monitor activities and detect any anomalies immediately, protecting our financial data.
Automated responses to known threats reduce the impact of possible incidents and improve our security posture.
Microsoft 365 Defender easily combines with other Microsoft 365 services and external security solutions, providing a complete and unified security solution.
Improved algorithms to minimize false positives in threat detection, reducing the impact on security teams and preventing unnecessary investigations into non-threatening incidents.
Advanced User-Friendly Interface:
Streamlined and intuitive user interface for the centralized dashboard, making it more accessible for security professionals with varying levels of expertise.
Greater Third-Party Integration:
Increased compatibility and integration capabilities with a broader range of third-party security tools
When running the Unified Audit, I like to use certain filters. I wish there as a way to save those filters, so I don't have to select them every time I do a Unified Audit.
We are pleased with the product and have no plans to look for alternatives. We are deeply invested in Microsoft ecosystem and Defender XDR provides seamless integration to other Microsoft products. For academic institution pricing is also quite affordable. In the contrary, we hope to extend the scope of the product for our entire environment.
ThreaLocker has done its job and has prevented malware from executing. It has stopped an encryption process once already. It has kept a user from going to a bad website. He tried twice and was wondering why he was getting an error message from ThreatLocker and ESET both.
Overall the UI is modern and OK to use. Attack story is quite nice visual of incident. Advanced hunting supports autocomplete so that helps doing KQL-queries efficiently. The product is quite comprehensive and one can get lost in the vast UI. Learning curve is quite high and navigation is complex. As product also continues to evolve the UI might change somewhat.
Technician and Analyst alike will love this tool as long as they learn to use it. They have fantastic study material that breaks everything down on it where to find settings and how to best manage the tool. End users are the only complaints we get only because they sometimes don't understand that installing a PDF convertor that is labeled as Free on the internet isn't always in their best interest.
In our experience there has been very little downtime for Microsot Defender XDR. For us there hasn’t been any single incident where we needed the product and it was not available.
Most of the time the product is as responsive as you might expect from cloud product. Occasionly the product is little slugish, this has been at most a slight irritation. Reports generate quickly ennough for our needs. We also not have found that Defender XDR slows down systems that it is integrated with
Their support throughout our onboarding of the product was fabulous. They not only took the time to carefully explain to teams not as well equipped with the lingo but explained to the tech team how to teach the other teams to be successful. They never once seemed impatient or annoyed with basic questions and didn’t pretend to know something when they needed to research an answer
You can email, call or do online chat with tech support. I love their online chat. They are quick and friendly. Also, if you need to show them something, you can give the chat technician permission from your Chat box to allow the tech access to your computer. They also can pull out your admin console on their side. They can look at your "Unified Audit" log and see the same thing that you can. They have a good KnowledgeBase that you can look for answers. They have what is called "ThreatLocker University" where you can go through tutorials and take tests.
The owners and co-founders work with you through Zoom Meetings. They walk you through how to use and setup ThreatLocker. They also have webinars. You also can go through ThreatLocker University online training.
Microsoft Provides a good training for the Microsoft 365 Defender and has a good learning paths to learn and take the exams and get your Certifications.
Using ThreatLocker University online training is very easy and informative. You take online tests to see how well you learned the material. It is great!
seemless and almost transparent. can be deployed by script if needed so every endpoint on our system get's it. if you have intune it gets dumped on the the endpoint by policy so nothing escapes it
ThreatLocker is a family ran business. The owners, co-founders work with you to ensure you are up and running as quickly as possible. They went to ensure your success with ThreatLocker.
Our product in that area, for instance as a security platform and for us it is for the moment really bad point. We started to move in that direction that there is that disconnect from the client management. So if there is some action that needs to be executed detected by security team, there is not an easy way to make that available to the team that is responsible for managing the identities as users, as the devices
Prior to buying ThreatLocker, we evaluated Tanium's whitelisting module. We felt that ThreatLocker's method of baselining existing applications and comparing them to known IoC's made for an easier implementation. To be fair, this was solely based on demonstrations by each vendor and not by actual PoC's. The implementation for ThreatLocker went smoothly and we have very few issues with the product that require support intervention. When support is needed, it is readily available via chat.
Azure cloud provides techical power to scale the product for whole organization. From organizational point of view scaling Defender XDR for various IT teams needs good collaboration and clear norms that all teams must agree to and follow.
ThreatLocker is very easy to add new ThreatLocker agents on computers and servers. It is very easy to do. You can install an agent on a computer or server in about 2 minutes or less.
