OpenText EnCase Endpoint Security vs. Trellix Intelligent Sandbox

It is more suited to environments that have a large internal user base since there will be more incidents that require forensic analysis. It will be less suited for environments that have a small internal user base due to the fact that there would be fewer incidents that require forensic analysis, but it really depends on the industry that a small internal user base is a part of.

Incentivized

McAfee Advanced Threat Defense is great in large enterprise environments with large, highly segmented networks. The administrator can create exceptions for specific applications as well as create exceptions through HAS which is very convenient for applications created in house. I do not recommend installing it on a computer with little ram memory, since this product demands a lot of resources and can be clearly distinguished in the Windows task monitor.

Incentivized

• Functionality meets minimal requirements, since it performs forensic investigations as advertised.

Incentivized

• Virus and threat prevention
• Sandbox option
• VPN
• It does run flawlessly in background
• It can detect email threats too

Incentivized

• Their UI definitely needs to be more user-friendly, right now it is very cumbersome to run and view investigations.
• Authentication mechanism should be a simple username/password, not certificate-based which is difficult to manage.
• Needs better support documentation for the product, it is difficult to find solutions to issues that we run into.

Incentivized

• There should be more updates.
• It is heavy on our system's storage or we need a high-storage system to run this tool.
• Its pricing is disappointing.

Incentivized

Because support is non-existent whenever you have a functionality issue using the product. Also since the UI is so cumbersome to use we could use as much support as possible. Whenever we ask for support we are told to take the training which costs us more money. I believe that support should be easily accessible and affordable for the client

Incentivized

Personally, I have only called our internal IT team about needing changes to permissions, not McAfee itself, but our IT team can make the changes though it seems to take them longer than I would think it needs to take. As someone who administers a different program, with different permissions, I would feel they should be able to make the exceptions faster and easier.

Incentivized

The other forensic tool that is a direct competitor to EnCase and wasn't listed above is the Forensic Toolkit or FTK. I believe that FTK is a better tool overall simply because it is easier to manage and use when it comes to investigations. Unfortunately, I wasn't part of the decision process and EnCase was the tool selected, otherwise, I would have recommended FTK.

Incentivized

McAfee brand is used, mcafee antivirus scan, mcafee drive encryption, mcafee DLP, mcafee cloud proxy. He Kaspersky at the corporate level and used his admin dashboard is a bit rough. I recommend mcafee since the graphical environment is very friendly with the administrator. We selected it because at the administration level it is more comfortable, support for end users is very easy, the administration console can create roles and segregate permissions.

Incentivized

• One negative impact would be that since the UI is cumbersome to use we would need to spend more money on training which is not always feasible.
• Another negative impact would be that since there is not much support available this slows down investigations due to finding out how to troubleshoot and fix functionality issues.
• One positive impact would be that since it meets minimal requirements when it comes to forensic analysis it gives us visibility on any malicious activity occurring on a user's endpoint.

Incentivized

• It does provide real-time threat prevention
• Good customer support
• System needs high configuration for seamless operation

Incentivized