Autopsy Digital Forensics vs. Trellix Endpoint Security ENS

Autopsy Digital Forensics is great for image investigation, just do a copy of the image, load it up and do the investigation. In the hands of DFIR specialist this software can do wonders in revealing various of pieces of information from an image. Software is easy to use and even a novice could use it without much trouble (assuming he has the knowledge of what to search for).

During the pandemic all our users worked remotely that was challenging from security perspective, so we had to deploy the endpoint protection system with cloud based monitoring server. By doing that we were able to keep safety for users workspaces even though some of them did not connect to VPN for a long time

Incentivized

• Easy to use UI
• Fast compared to competitors
• Ability to use modules and plugins
• Portable
• Just does the job

• Provides high fidelity alerting.
• Allows CSOC analysts to perform forensic triage and alert investigations through containment from a single pane of glass.
• Provides alert telemetry across on-disk and in-memory attacks.
• Supports many additional 'bolt-on' modules to provide additional alert context or capabilities.

Incentivized

• None - this software is amazing.

• My biggest flak with McAfee Endpoint Security is that it is quite resource-intensive. It does tend to make the system a little slow. You get security at the expense of your machine's speed.
• Even though the drive encryption makes the system more secure, it takes a lot of time to first enter the very long password, and then for it to decrypt the whole machine. This sometimes clashes with Windows update and causes a lot of complications which leads to boot loops.

Incentivized

So below is my breakdown, Pro's: Centralized Management, Comprehensive Protection and customization. Con's: Initial cost

Incentivized

The support is pretty good, and I haven't had any issues with getting the highest quality technical support when there are issues. Tech support representatives that I have dealt with know the product quite well and have solved many issues that I have had with the product in the past. The only issue I have with support is that it can be quite expensive.

Incentivized

Autopsy was easier to use, I liked the UI more and it just felt better.

We only selected McAfee because we are already using ESET NOD32 for the protection of our desktops and laptops. We didn't want to use the same software for our servers so we chose McAfee instead. I personally like ESET Smart Security better than McAfee when deploying it on a desktop or laptop because I think it protects the PC better. When it comes to web protection, policy updates, etc., McAfee is the better choice and that's why we deployed it on our servers.

Incentivized

• Easies forensic investigations
• Has great training platform
• Has a free version

• This tool helped us in delegating the asset safety responsibility to the client level by 80%, leaving 20% for the management console.
• With a decent pricing, the benefits are slightly above expectations. The ROI is good.
• But, considering most of the malware comes from internet, with a good email security appliance and next gen firewall in place, the online security alerts are now redundant. It could be something that can be termed as overkill on the budget.

Incentivized