5 star threat prevention/detection product exceeding our expectations
Use Cases and Deployment Scope
FireEye Network Security named FireEye NX is our main solution for threat detection and mitigation of 0day and
APTs in the network. NX is being used throughout the company. Even we deploy NX
solutions to other companies. It’s highly effective and scalable in
terms of detection and prevention. FireEye NX usage within the FireEye
Ecosystem (HX,EX,CMS) enhances the value. SOC team is constantly monitoring the
FireEye alerts other than the SIEM generated incidents. It’s a very low false positive rate compared to other products thus increas[ing] the SOC efficiency. With
ease SOAR integration helps to automate the IOC distribution. Our Security team
and management trust the product. Advanced detection capabilities ensure the targeted
attacks will be detected and blocked before it arrives to network.
Pros
- Advanced detection of targeted attacks.
- Mandiant team effort is a big plus.
- Inline mitigation capabilities particularly well.
- Different deployment models for specific needs.
- License and information sharing selection 1 way or 2 way mode.
- Frequent updates.
- Low false positive rates.
- FireEye sandboxing is immune to sandboxing attacks.
- Central management (CMS) capabilities for managing several NX's.
- Extra IPS/IDS functionality in the product.
- Smartvision specific to lateral movement detection.
- Upgrades and updates with zero down time.
- Local FireEye support is superb.
- Multiple deployment scenarios (span, inline) in the same NX for different interface pairs.
- SSL inspection support.
- No need to maintain, build or updates the images. It's highly automatic.
Cons
- Very first detected APT sample can pass the NX even it's inline blocking mode.
- Performance optimization for busy networks is cumbersome.
- CMS does not provide all the management capabilities, CLI or local config. Should be done for advanced customization.
- Constant limitations of tcpdump/ packet capture for 10G interfaces.
- IPS functionality is a bit cumbersome, not a full feature IPS, lack of signatures and customization of IPS signatures.
- It's not a full NDR solution or a UBA solution.
- Lack of device or user mapping.
- Forensics is based on the specific APT. May not provide the whole story and need some additional tools.
- You cannot make manual submission to NX (needs AX).
- You cannot access the kernel directly for deep analy[sis] or troubleshooting (assist from FireEye Support should be taken).
Likelihood to Recommend
It’s a dedicated Network Advanced Threat Detection and
Prevention solution. Easy maintenance and low operating costs fit perfectly for
SMEs. Variety of appliance selection makes NX the perfect choice for large
enterprises. As it’s a dedicated solution with its own appliance, price is higher
compared to NGTP add on solutions. FireEye is an ecosystem therefore when you’ve
the EX or HX vice versa, you should be looking to NX. Otherwise, you’re missing
the threat intel exchange on the network side reverse is the true. Sizing is
important before the purchase, if you select a low end model for a busy network
you lose your initial investment. For multiple NX deployments I highly
recommend CMS. Without CMS you’ll lose the threat intel exchange and this will
negatively reduce the risk scores.
