Splunk User Behavior Analytics vs. Trend Micro Deep Discovery

Splunk User Behavior Analytics application is necessary when any company wants to capture the threat based on user behavior instead of just counting the number of occurrences of particular event. With Splunk UBA, we can analyse number of anomalies captured and which in turn creating threats which are nearly true positive.

Incentivized

I think Trend Micro Deep Discovery will be suitable for every system, but considering its cost, companies that will want to work in this scenario will usually have systems with multiple branches, multiple clients, and systems that host many independent platforms and communication methods - protocols. In summary, if you have a medium to large structure and you cannot protect this structure because you cannot monitor it in every area, you definitely need this product.

Incentivized

• Monitor and troubleshoot for any system errors.
• Get the insights on application data sets and do some predictive analysis.

Incentivized

• Indepth Email analysis
• Attachment scanning
• Spam Protection
• Phishing Detection

Incentivized

• Performance-wise, it can be improved. Queries take a long time.
• Dataset exploration - More data visualization charts can be added.

Incentivized

• When viewed as a single product, it is like a secret box.
• When viewed together with other modules and XDR, vision one, it can be seen that it is a complete system.

Incentivized

Easier we were using Splunk Enterprise on heavy forwarder on which all the add-on were installed and were using Splunk Cloud with respect to search head and indexers stack. And with Splunk Enterprise Security premium app, we were relying on correlation rules which were throwing more number of false positive but after implementing Splunk UBA, we are now getting real-time true positive threat or incidents.

Incentivized

When you use Trend Micro Deep Discovery, it feels like you are running the SOC team of a company like Trend Micro in your own office. Other companies can also provide this, but the feeling it gives feels like they are providing service by phone from a distant city.

Incentivized

• Fewer team members to work on real threats.
• Less time required to deal with real incidents.
• Easy to implement across the network.

Incentivized

• Has blocked 99% of Spam
• Has detected 100% of encrypted malware files
• Able to handle 1000 of emails

Incentivized