Item: Attivo Endpoint Detection Net (EDN)
Rating: 7
Author: Nishant Aggarwal

Use Cases and Deployment Scope

We are using Attivo Endpoint Detection Net (EDN) to deploy breadcrumbs/deceptive tokens at production endpoints to mimic the servers and data residing on servers. Furthermore we have used Attivo Endpoint Detection Net (EDN) to build profiles to setup decoy environment on our production servers. through Attivo Endpoint Detection Net (EDN) we have mapped deflect profile to deflect malicious communication to engagement virtual machines.

Pros and Cons

To mimic production servers to deceive attackers
To detect the lateral movements of adversary through machine learning algorithms
To feed dummy data on production servers through threat strike feature

Attivo Endpoint Detection Net (EDN) should have capability for getting forensics packages from compromised systems in my opinion.
I believe Auto phishing email detection capability should be improved to meet industry requirements to tackle phishing attack vector
Malware detection capabilities should be improved to work to kernel level for better visibility in my opinion.

Return on Investment

Attivo Endpoint Detection Net (EDN) helps to protect information hence Attivo Endpoint Detection Net (EDN) is securing sensitive data therefore ROI is better as loosing the data is much more costlier as per Business Impact Analysis.
In small organization ROI is not effective as cost of Attivo Endpoint Detection Net (EDN) is a bit high and data being protected through EDN is not high value asset in my opinon.
It is a better technology to detect cyber threats so anyway it is recommended to use for better security posture.

Alternatives Considered

Red Canary, FortiDeceptor and CounterCraft

Attivo provides a user friendly management with a centralized manager. We can do configuration of Attivo Endpoint Detection Net (EDN) from a centralized console and deploy the Attivo Endpoint Detection Net (EDN) very easily. In other deception tool like forti deceptor etc, they have a bit poor user interface in my opinion and use-ability feature are improved in Attivo as compared to its competitors solutions I believe.

Key Insights

Do you think Attivo Endpoint Detection Net (EDN) delivers good value for the price?

Yes

Are you happy with Attivo Endpoint Detection Net (EDN)'s feature set?

Yes

Did Attivo Endpoint Detection Net (EDN) live up to sales and marketing promises?

Yes

Did implementation of Attivo Endpoint Detection Net (EDN) go as expected?

Yes

Would you buy Attivo Endpoint Detection Net (EDN) again?

Yes

Other Software Used

Arbor Sightline, FortiAnalyzer, Vectra Threat Detection & Response Platform

Likelihood to Recommend

Attivo Endpoint Detection Net (EDN) is a suitable option in mid level and large companies to detect insider threats and stealthy attackers. It is highly recommended where data is highly sensitive and there are chances of attack to get access to critical revers to get saves credentials and stored files. for small and medium business this solution is not recommended where perimeter security is already configured.

Attivo Endpoint Detection Net (EDN)! The sweetest honeypot amongst all

Modules Used

Overall Satisfaction with Attivo Endpoint Detection Net (EDN)