Microsoft Forefront (Discontinued Product) vs. Palo Alto Networks Cortex XDR

In large deployments, I have found Microsoft Forefront to be very effective at combating the majority of threats faced by our users. It provides the base platform for catching threats that would otherwise threaten our users and their data. If you have an environment that is under constant malware threat, then a secondary program may be needed as required.

Incentivized

Malware that doesn’t leave files behind has become widely available. Anyone who can afford to reverse this trend should purchase technology. Application whitelisting isn’t for everyone, and Palo Alto Networks Traps can help. Enterprises looking for a low-affected, next-generation solution with high protection should consider it. PAN Traps is a great product at a reasonable price, and I highly recommend it.

Incentivized

• SCEP is a light weight client which is minimally impactful on the user end.
• Forefront's management console provides excellent monitoring and reporting.
• Setup and configuration is very easy.

Incentivized

• Direct Access to devices via Live Terminal which provides operations with scripting, triage, and preservation of artifacts.
• Behavioral Indicators of Compromise which provides alerts on events regarding groups of hosts and their signatures.
• Querying complex data sets involving a variety of devices for network connections, hashes, DNS, etc.

Incentivized

• Malware detection is not quite 100%. We have to use a secondary program occasionally.
• On low ram and weak CPU systems scanning can freeze the machine.
• The same reporting tools that are on the console version, aren't on the client.

Incentivized

• Traps doesn't seem to function as a traditional A/V very well, so it's better as another layer to your endpoint protection
• Traps can cause issues with some legacy or custom programs, so exceptions may have to be made
• Traps falsely identifies things as malicious at times, this is not often though

Incentivized

Cortex XDR does a very good job of blocking suspicious and threatening items. However, as with all software of this nature, it will sometimes block known-good items. The difficulty is in manually whitelisting these known-good items. The interface to whitelist is confusing even for a seasoned IT professional and has been the single most frustrating experience of using Cortex XDR

Incentivized

The support we receive from Palo Alto is one of the best aspects of Traps. It is very easy to recommend their support. It seems much easier to connect directly with someone with a deep understanding of the product rather than other companies where you basically have to make an airtight case that it is some kind of non-standard issue that can't be solved with existing documentation. Palo Alto digs deep and helps with advanced troubleshooting to get things working.

Incentivized

The biggest advantage that MSF and SCEP provide over Norton is: One: Far less client overhead required. Both Norton and McAfee are highly intensive client side when in use. Two: We've had far better luck using the Microsoft system with its detection capabilities, versus the others. Three: It is tied right into the Microsoft updating system, which provides central updating capabilities of av/mal/windows updates.

Incentivized

Traps is the slickest interface, easy to use and intuitive rule making, and the rest just didn't quite stack up to the performance level of Traps. McAfee and Kaspersky just hog processor and RAM power. I didn't like the interface and functionality of SentinelOne as much as Traps. Palo Alto really put a lot of time into the development of this software, and had some of the founding fathers of IT Security heading the development process. Can't beat that.

Incentivized

• Less turnaround on virus based issues.
• Helps reduce malware issues over time.
• Can breed overconfidence in the system, so people don't always try a second tool.

Incentivized

• After putting Palo Alto Networks Cortex XDR on a user's system, users came back with a positive response that there are no performance issues now.
• We are able to track and control granular suspicious and malicious activities.
• Web controls are missing, which if they would have been there would have been very helpful.

Incentivized