Carbon Black EDR vs. Kaspersky EDR Expert

Investigating suspicious behavior on an endpoint, ability to kill processes and run files on the host. Ability to view every change made on a system in a timeline format. Ability to search across the enterprise for indicators of compromise. Ability to pull files from the host for further analysis. Ability to safely communicate with an endpoint by isolating it from the rest of the network

Incentivized

It is a very comprehensive product to learn everything about incidents on the windows hosts. Also EDR can create some incidents during its analyze. But it is pretty useless when we are talking about linux systems. Further it is not so good when algorithms are not described clearly (like it was when we used Traps). So there are some ways to improve the product

Incentivized

• Process tree view of endpoint activity
• Ability to pull files from host
• Threat Intelligence integration
• Isolate a host

Incentivized

• Detection
• Embedded Sandbox is a really good stuff, I can see detailed activity with visualization of any malicious sample
• Simple interface. Usability.

• Number of false positive which are triggered due to threat feeds are sometimes more needs to be fine tuned by the client.
• In very rare scenarios processes are not captured properly.

Incentivized

• It would be nice to have more insight into the kill chain of potential infections and malware.
• Remote interface is a little lacking as to why a file was flagged.

Incentivized

I believe the Kaspersky EDR Expert systems represent significant cyber risks for government and commercial enterprise customers

Incentivized

It has better UI.

Incentivized

Kaspersky EDR Expert delivers much better protection and detection rate

• It is helping to protect us from potential loss of revenue that would be caused by malware or a compromised account.
• It took some time in deploying in the environment , but that time is much worth it because of the results we are getting now.
• It helps in hunting, which help us check and protect our environment from any cyber attacks.

Incentivized

• Automating response task on suspicious activity
• Improving IT specialists skills and IS specialists skills
• Increased visibility of what malware really do on endpoint