EclecticIQ Platform vs. Webroot Endpoint Protection

ElecticIQ has an architecture where it usually needs decent computing power within the organisation. The central console along with the ELK servers and PostgreSQL sever needs their own space in a distributed setup. This could be a little too expensive for small-scale organisations. But for the organizations having mid to large-scale networks. EIQ is a decent solution to serve the purpose.

Incentivized

The software tends to do a good job of basic protection but is not the best for larger clients and is not as powerful as some others offered on the market today. The support is not the best either, have had a hard time getting assistance in the past trying to resolve issues.

Incentivized

• Effective correlation of IOCs
• Averaging out the Confidence Score based on different intel sources.
• Serves as an excellent liaison points between the Intels and SIEM/SOAR stack.

Incentivized

• It is very light weight and does not tax the computers resources
• Has a quick scan and does not take forevere when scanning
• It's central management on the web makes it easy to use and gives tons of control for Admins

Incentivized

• Misses on a global search bar which can directly gives out the result like VirusTotal.
• The GUI could be more friendlier. Too many filters and graphs may overwhlem the user sometimes.
• The ElasticSearch(searching for IOC in the in-house EIQ database) is a little slow compared to its counterparts.

Incentivized

• There are several configuration options for both end-point and DNS protection. Would like a more simple way to understand and validate settings.
• Support is heavily video or FAQ based although you can submit a Support Ticket. Would like more availability to an actual support engineer.
• Overtime you can forget how to change setting - a refresher course would be nice, especially as new features are added to the solution.

Incentivized

It has proven successful so far in our environment for controlling malware/virus outbreaks.

Incentivized

Webroot Endpoint Protection has been great for us, as its simple, cloud-based management console allows us to quickly deploy easily monitor all of our endpoints. However, it could improve by offering more customizable reporting options for deeper insights into security events and the interface could also use some updating, as it feels a bit dated.

Incentivized

Support has been reliable up to this point. A request can easily be generated via the console and support responding in a reasonable time. We have not had any major issues other than the basic agents not communicating with the console and the like.

Incentivized

I had some difficulties with remote users. I ended up needing to open a remote tech support session and finish the process. Other than a few speed bumps, I was impressed with the engineering of the install. Because of time differences, I was done installing in two days. The cost, per license, could be less.

Incentivized

The most important feature of EclecticIQ which gives it an edge compared to other TIPs is that it performs segregation of IOCs based on the relevance of it and the links that IOCs might have which other adversaries. The graphical format mapping where the user can easily figure out how the IOCs have connections to different binaries is another advantage. One can set the half-life time for an IOC which will reduce the confidence score as per one's need.

Incentivized

Webroot is good in a way that it is an all encompassing solution one stop shop for protecting endpoints but it needs to be managed and licensed. Some users do not need constant protection or need to have it on their machines in where the combination of Field Effect and Malwarebytes is more effective.

Incentivized

• Positive: Effective usage of all the premium Intels in a uniform fashion. No need to log in to each tool time and again.
• Positive: SOC Analysts spends lesser time on the internet and the analysis for the IOCs with graphical format is fulfilled by EclecticIQ.
• Negative: Higher costs over the resource utilization in the initial setup.

Incentivized

• The DNS filtering allows for a very granular configuration of endpoints
• The cost to benefit ratio is good. It is not a real EDR player yet, but the development looks promising
• Its best feature is integration with our MSP software, providing actionable tickets.

Incentivized