Item: Attivo BOTsink
Rating: 8
Author: Verified User

Use Cases and Deployment Scope

We use Attivo BOTsink to detect network security events and to identify unusual behavior. Some behaviors which Attivo BOTsink has detected are MITM attacks, directory enumeration, TCP scans, and other network scanning procedures.

Pros and Cons

Identifies devices
Provides threat details in real time
Provides network topology with potential threat paths

Dashboard is difficult to navigate
Configuring alerts is time consuming
Many false positives

Most Important Features

Live decoys machines to detect threats
ThreatPath
ThreatStrike - decoy user accounts

Return on Investment

Advanced reporting has saved from hiring additional personnel to monitor security threats
Real time identification of threats saves response time from actual breach
Third-party needed to be leveraged to help configure Attivo BOTsink

Key Insights

Do you think Attivo BOTsink delivers good value for the price?

Yes

Are you happy with Attivo BOTsink's feature set?

Yes

Did Attivo BOTsink live up to sales and marketing promises?

Yes

Did implementation of Attivo BOTsink go as expected?

Yes

Would you buy Attivo BOTsink again?

Yes

Other Software Used

ADAssessor, Arctic Wolf Managed Risk, Sophos Intercept X for Server, Sophos Intercept X, Cisco DNA Center, Cisco DNA Spaces, FortiClient, FortiMail

Likelihood to Recommend

Attivo BOTsink is a great network security tool for organizations that may not have a dedicated security team, but need to have threats reported in real time. It seems well suited for medium to large sized organizations that may have several subnets, VLANs, and remote locations.

Attivo BOTsink-Detect network security threats in real time

Modules Used

Overall Satisfaction with Attivo BOTsink