Palo Alto Networks Cortex XDR vs. StormShield Endpoint Security

In a scenario where EDR is a requirement or necessity XDR performs well with or without a SIEM. There are millions of events and logs to parse through and XDR is capable of handling the large load. On top of the large data that is being parsed, features such as Live Terminal, File Retrieval, OS support, and general Metrics, the tool has room to grow and provide a lot for a Security team or organization. Incident Response is a great example of how XDR can shine

Incentivized

It is a very good device to use on a small and medium size company (0-400 users). However I wouldn't use it for very big companies.

Incentivized

• Great tool to help analyze and identify unknown malicious software on workstations, servers, and mobile devices.
• Integration with Panorama help to quickly and efficiently identify potential malicious files.
• Integration with Wildfire helps to quickly deploy signatures not only to endpoints but to firewalls as well.

Incentivized

• Easy to manage on a daily basis
• It goes very deep into analyzing the trafic and the configuration is very thin.
• The first configuration is not so complex

Incentivized

• We encountered some glitch in a certain version of the agent. When we deployed newer version, the policy set on the previous version was white-listed/overwritten.
• Moving to encrypted based connection (communication between agent to server) is troublesome, coz we need to uninstall the agent first.
• Need to have a more flexible reports/dashboard where we can customize it
• We feed Traps log to our SIEM, however the information sent to the SIEM was not complete, but we need to investigate more probably some faults are on us

Incentivized

• Not everything is possible on the web administration page. We need to use the ssh console to do many things.
• The logs viewer is not as helpful as on other brands (like ASTARO, SOPHOS,...)

Incentivized

Cortex XDR does a very good job of blocking suspicious and threatening items. However, as with all software of this nature, it will sometimes block known-good items. The difficulty is in manually whitelisting these known-good items. The interface to whitelist is confusing even for a seasoned IT professional and has been the single most frustrating experience of using Cortex XDR

Incentivized

The support we receive from Palo Alto is one of the best aspects of Traps. It is very easy to recommend their support. It seems much easier to connect directly with someone with a deep understanding of the product rather than other companies where you basically have to make an airtight case that it is some kind of non-standard issue that can't be solved with existing documentation. Palo Alto digs deep and helps with advanced troubleshooting to get things working.

Incentivized

Traps provided us with a cloud-based platform that made our lives a lot simpler. Nothing like Traps exists in the market and I've never used anything like it. Others, on the other hand, were a lot slower to respond. Malwarebytes and other enterprise-level malware software are also available, but they do not fall under the same heading.

Incentivized

Installation and day to day use is more friendly.

Incentivized

• Traps has paid for itself in time saved re-imaging PCs to clean them
• Traps gives us a lot of good insight on what's being run on our endpoints
• Traps is a great extra layer of security for our end users and minimizes malware outbreaks, which in turn minimizes downtime

Incentivized

• It does the job very well once it is correctly configured. By that I mean, it is functioning with the least waste of time and effort for network administrators.
• If needed the support is efficient.

Incentivized