5 star threat prevention/detection product exceeding our expectations
Pros
- Advanced detection of targeted attacks.
- Mandiant team effort is a big plus.
- Inline mitigation capabilities particularly well.
- Different deployment models for specific needs.
- License and information sharing selection 1 way or 2 way mode.
- Frequent updates.
- Low false positive rates.
- FireEye sandboxing is immune to sandboxing attacks.
- Central management (CMS) capabilities for managing several NX's.
- Extra IPS/IDS functionality in the product.
- Smartvision specific to lateral movement detection.
- Upgrades and updates with zero down time.
- Local FireEye support is superb.
- Multiple deployment scenarios (span, inline) in the same NX for different interface pairs.
- SSL inspection support.
- No need to maintain, build or updates the images. It's highly automatic.
Cons
- Very first detected APT sample can pass the NX even it's inline blocking mode.
- Performance optimization for busy networks is cumbersome.
- CMS does not provide all the management capabilities, CLI or local config. Should be done for advanced customization.
- Constant limitations of tcpdump/ packet capture for 10G interfaces.
- IPS functionality is a bit cumbersome, not a full feature IPS, lack of signatures and customization of IPS signatures.
- It's not a full NDR solution or a UBA solution.
- Lack of device or user mapping.
- Forensics is based on the specific APT. May not provide the whole story and need some additional tools.
- You cannot make manual submission to NX (needs AX).
- You cannot access the kernel directly for deep analy[sis] or troubleshooting (assist from FireEye Support should be taken).
Most Important Features
- Threat exchange and intel.
- Low false positive ratios.
- Uptime values are very high for both inline and span modes.
- Advanced detection and mitigation capabilities ensuring the highest level protection.
- FireEye Ecosystem.
- Proper detection for C&C and bot.
Return on Investment
- As [a] financial company on the digital markets, we need to be safeguard for 0days and targeted attacks. FireEye NX provides the best updated protection with its enhanced capabilities.
- Security score based on detection/prevention metrics [is] very high ensuring the highest level of security.
- APTs in our region successfully detected and mitigated by the NX.
- For the ROI, in a six month period FireEye is paying off its [investment].
- One negative thing, especially with increasing network bandwidths, [is that] you need to make [the] investment every two or three years.
Alternatives Considered
Palo Alto Networks WildFire and Trend Micro Deep Discovery
Other Software Used
Trend Micro Deep Discovery, Palo Alto Networks WildFire, Check Point 13000 Appliances
