Carbon Black EDR

Users have found VMware Carbon Black's endpoint protection solution to be highly effective in improving endpoint security and reducing response time to attacks. The product offers robust malware protection for devices running Mac, Windows, and Linux, specifically Ubuntu and Red Hat. Customers appreciate the ability to pipe logs to an S3 bucket for archival purposes.

Key features such as watchlist management, vulnerability management, and malware analysis have been instrumental in threat hunting activities. The incident response capabilities of VMware Carbon Black EDR have proven valuable for SOC teams and incident responders. The product provides a comprehensive approach to securing endpoint networks through data collection, analysis, and threat detection mechanisms.

Users have found that traditional antivirus solutions are not as effective as VMware Carbon Black EDR in detecting advanced attacks. The product eliminates the need for downloading and deploying signatures by replacing signature-based antivirus systems. This has resulted in improved efficiency and faster response times.

One notable aspect users appreciate is the actionable insights provided by Carbon Black EDR, which simplifies the investigation process. The product's AI-based technology has garnered praise for its ability to predict and prevent viruses. Additionally, customers value the depth of telemetry provided by Carbon Black EDR, enabling effective threat hunting and incident response.

VMware Carbon Black EDR has significantly enhanced visibility into endpoints, making investigations and root cause analysis easier. Users have been able to quickly detect and isolate hosts affected by attacks, facilitating prompt response and mitigation. The product has also aided users in determining the source of infections and understanding the timeline of security incidents.

In sensitive environments where detailed visibility is crucial, VMware Carbon Black EDR has proved its worth. Users appreciate the added layers of endpoint security it provides along with granular inspection of processes. Furthermore, customers have utilized the incident response and forensics capabilities of Carbon Black to obtain actionable data instead of relying on guesswork.

The product includes threat feeds and allows users to input their own threat intelligence, enabling them to build watchlists and alerts for analysts. The visibility into endpoints provided by the product has been highly valuable for incident response and security investigations, helping users detect and contain threats while improving overall endpoint visibility.

Users have also found value in the memory retrieval feature of CB Response, which has proven useful for incident response purposes. Overall, customers have successfully leveraged VMware Carbon Black EDR to strengthen their security posture, enhance threat detection capabilities, and streamline incident response processes.