Palo Alto Networks Cortex XDR vs. ThreatLocker

Malware that doesn’t leave files behind has become widely available. Anyone who can afford to reverse this trend should purchase technology. Application whitelisting isn’t for everyone, and Palo Alto Networks Traps can help. Enterprises looking for a low-affected, next-generation solution with high protection should consider it. PAN Traps is a great product at a reasonable price, and I highly recommend it.

Incentivized

I have tested two of software besides ThreatLocker. ThreatLocker by far, was the easiest of the 3 to work with and setup. One of the companies' software was too complicated to run and setup. The other one lacked a lot of the features that ThreatLocker had. ThreatLocker came with many prebuilt template for common software and utilities, like Office365, putty, Firefox, Google, etc. It came with a bunch of prebuilt blocking/ringfencing rules for utilities like powershell, hyper-v psexec, and many others. This saves setup time. Unfortunately, ThreatLocker will let you download something from the MS Store, sometime it will let you execute and sometimes it won't. I would like to see this to be able to block the download from MS Store until ThreatLocker approves the download.

Incentivized

• Direct Access to devices via Live Terminal which provides operations with scripting, triage, and preservation of artifacts.
• Behavioral Indicators of Compromise which provides alerts on events regarding groups of hosts and their signatures.
• Querying complex data sets involving a variety of devices for network connections, hashes, DNS, etc.

Incentivized

• Application Control
• Privileged Access Management
• Storage access control

Incentivized

• Traps doesn't seem to function as a traditional A/V very well, so it's better as another layer to your endpoint protection
• Traps can cause issues with some legacy or custom programs, so exceptions may have to be made
• Traps falsely identifies things as malicious at times, this is not often though

Incentivized

• Ease of moving between organizations
• Removing agents from clients who depart
• Some UNC path definitions for local files and folders

Incentivized

ThreaLocker has done its job and has prevented malware from executing. It has stopped an encryption process once already. It has kept a user from going to a bad website. He tried twice and was wondering why he was getting an error message from ThreatLocker and ESET both.

Incentivized

Day to day, Cortex is easy to use when you have no alerts and when an agent upgrade doesn't go south. Alerts are far too "clicky", there's too many steps to drilling down to what actually happened to trigger an alert. Investigating alerts in Cortex takes about 5x longer than it should.

ThreatLocker ease of use allows me to get the answers I need to any threats or denied action that ThreatLocker took. The "Unified Audit" is a great tool to show what is happening/executing on a user's computer or on a server. Unified Audit will allow to look at what steps a programs takes when it executes. It will show you if it calls on Powershell or what DLL's it is executing and many other things.

Incentivized

There is rarely ever an outage. I have seen slowness in ThreatLocker service. But that is very rare too!

Incentivized

ThreatLocker is always available. The admin's console loads very fast and report runs almost instantly. It does not interfere with operating system.

Incentivized

The support we receive from Palo Alto is one of the best aspects of Traps. It is very easy to recommend their support. It seems much easier to connect directly with someone with a deep understanding of the product rather than other companies where you basically have to make an airtight case that it is some kind of non-standard issue that can't be solved with existing documentation. Palo Alto digs deep and helps with advanced troubleshooting to get things working.

Incentivized

You can email, call or do online chat with tech support. I love their online chat. They are quick and friendly. Also, if you need to show them something, you can give the chat technician permission from your Chat box to allow the tech access to your computer. They also can pull out your admin console on their side. They can look at your "Unified Audit" log and see the same thing that you can. They have a good KnowledgeBase that you can look for answers. They have what is called "ThreatLocker University" where you can go through tutorials and take tests.

Incentivized

The owners and co-founders work with you through Zoom Meetings. They walk you through how to use and setup ThreatLocker. They also have webinars. You also can go through ThreatLocker University online training.

Incentivized

Using ThreatLocker University online training is very easy and informative. You take online tests to see how well you learned the material. It is great!

Incentivized

ThreatLocker is a family ran business. The owners, co-founders work with you to ensure you are up and running as quickly as possible. They went to ensure your success with ThreatLocker.

Incentivized

Traps is the slickest interface, easy to use and intuitive rule making, and the rest just didn't quite stack up to the performance level of Traps. McAfee and Kaspersky just hog processor and RAM power. I didn't like the interface and functionality of SentinelOne as much as Traps. Palo Alto really put a lot of time into the development of this software, and had some of the founding fathers of IT Security heading the development process. Can't beat that.

Incentivized

I honestly have not seen many other programs like Threatlocker so I do not have any to compare to. Auto-Elevate may be the closest, however I did not evaluate them as part of my decision. Threatlocker does do a great job at onboarding which made deploying, setting up, and troubleshooting the program a breeze

Incentivized

ThreatLocker is very easy to add new ThreatLocker agents on computers and servers. It is very easy to do. You can install an agent on a computer or server in about 2 minutes or less.

Incentivized

• After putting Palo Alto Networks Cortex XDR on a user's system, users came back with a positive response that there are no performance issues now.
• We are able to track and control granular suspicious and malicious activities.
• Web controls are missing, which if they would have been there would have been very helpful.

Incentivized

• Too early on to tell, however, if ThreatLocker ends up blocking just one ransomware attack for any of our clients, I'd argue that it payed for itself.

Incentivized