Cortex XDR

Good Endpoint Security Solution

Commentaires : Traps is good software to have. It did stop some malicious software that was downloaded.

Avantages :

This product doesn't do the old-fashioned signature based detection, but works by observing attack technique and behaviors. One of our workers had an Excel document which tried to reference some command line software to manipulate data. Of course this is very much how a virus could work, so Traps blocked it. Although this was a false positive, the solution using that Excel was not approved so Traps did a good thing. Management through the admin portal is visually pleasing and intuitive for most if the options.

Inconvénients :

We moved from on-prem installation to Cloud version of Traps. In the beginning the training options for the cloud version were almost non-existent. Even now, our training option was cancelled because of no other applicants for it. There is a free on-demand version of the training which I now will settle for. Managing the "Agent Installations" is not really intuitive.

Cortex XDR Review

Commentaires : Cortex is a solid product. We haven't had any major complaints from the user community. We haven't had to unblock any major products that were perceived as spam at this point. Many other products tended to block updates to products due to the executable file not being recognized by their database. We haven' had that issue with Cortex.

Avantages :

Our team is responsible for the deployment of Cortex into our Mac and PC environment. The agent was very easy to distribute utilizing our Deployment Software tool. The dashboards provide an excellent view into what is active and reporting back to the tool. We haven't had any major whitelist issues between the tool and endpoints.

Inconvénients :

I would like to see the scan on demand option as an easy one-click process for end users so they can be pro-active.

Difficult to get setup

Avantages :

Quick intrusion/threat detection, silent background running

Inconvénients :

Extremely difficult to roll out to company, was blocking company wide software such as 7-zip, was blocking Skype for Business messages, took forever to troubleshoot and properly roll out and install. In addition, the software does not have a great UI, it appears very serious and unnecessarily serious when detecting small threats

Excellent product with great flexibility in terms of outcomes

Commentaires : I evaluated this technology and compared it to other SOAR and NDR platforms in the space. We did choose Cortex XDR due to the use case coverage and close knit relationships with Palo's executive teams. Overall, very happy with the acquisition of this product line in our IT environment and the security program has benefited directly because of the day-to-day use of this product across a wide variety of business and technical use cases in our environment.

Avantages :

The ability to create custom playbooks and integrate APIs from disparate vendors was the highlight of our use of this product.

Inconvénients :

Customer support can be patchy. Also, depending on the use case being implemented, documentation and systems engineering support from Palo can vary. We were able to work through these issues being an Enterprise user for PANW, however, small to mid size companies may find the time to value to drag a fair bit.

Much better than signature based AV

Commentaires : We needed a malware protection system that really worked. We had tried other AV programs but they would all fail at some point. We have had zero problems with workstations getting infected since using Traps.

Avantages :

Traps does not rely on AV signatures. It relies on detecting the programmatic exploits that virus writers use to infect PCs. It also uses the behavior of programs to detect malicious activity. And it really works. It has caught malicious infected documents, spyware, adware, and grayware trying to infect our systems. And it stops the programs cold. Also, the new version is cloud based so we can protect remote users.

Inconvénients :

The endpoint agent updating process is still not as automatic as I think it should be. But it has been vastly improved in the latest version.