Carbon Black EDR

Top Rated Carbon Black EDR Alternatives

SanerNow

(59)

4.5 out of 5

Visit Website

Carbon Black EDR Reviews & Product Details

admin

Verified User in Electrical/Electronic Manufacturing

Enterprise(> 1000 emp.)

Validated Reviewer

Verified Current User

Review source: Organic

Jan 23, 2016

"Carbon Black - Detect and Respond"

What do you like best about Carbon Black EDR?

Cb has provided us visibility into threat behavior beyond any product out there today. The ability to ban malicious files, create feeds, watch lists, open API, integrations with many other products (and ability to add other products easily), Live Response, isolation and much more, make Cb the differentiator over any other ETDR product on the market today.

Carbon Black provides the ability to also go back in time, which defeats a lot of other products in the space that only can go back a short period of time without disrupting the endpoint. The centralized infrastructure methodology makes sense for Cb as it technically can save money vs other products that will run CPU/mem to the max and begin to overwhelm the workstation/server. Cb is a very lightweight sensor, we see around 0-1% CPU, and 10-28Mb of memory. 28Mb on the high end for instances where it is a busy server like TMG or Exchange.

Cb is deployed to around 60k endpoints with no issues. We've had minor hiccups over time caused by Cb, but nothing widespread and nothing that wasn't fixed on the new patch level etc.

Working with Cb is probably one of the best things about the product. The PM team, engineering, executive team are all great people. Not forgetting the sales team, they are good people too. Everyone at Cb is committed to working and ensuring their product is the best. We have been with Cb since 4.2 and it has really grown a lot since.

the API - is probably one of the most important features to Carbon Black that many products out there fail at. The ability to automate and orchestrate a lot of threat hunting, or even remediation tasks is incredible. Many products fail at this part, or place in API in after the fact. Cb is also 100% committed to ensuring the API is very flexible. They have some of the best developers working it.

Integrations - Cb allows for many integrations, whether ones they've created or ones you create. It's very flexible.

Splunk - we use the cb-event-forwarder to dump most all data to Splunk. This allows us to quickly perform analytics on raw endpoint data. With this, we've taken our detection and response to the next level. Review collected by and hosted on G2.com.

What do you dislike about Carbon Black EDR?

Not a deal breaker in any sense -

1. High availability. Not really an issue since the sensors cache data until the cluster is back online.

2. Cluster upgrade process could be better.

3. Solr has got to go... Review collected by and hosted on G2.com.

Recommendations to others considering Carbon Black EDR:

Carbon Black is not traditional IR. It's not slow in any sense and it provides a lot of data. The point being, it will change the game and disrupt the attacker far faster than you will ever do with MIR or HX. Nothing truly compares to what Cb can provide you. If you are having issues, or want to go beyond waiting hours for triage to appear, you should really look at and consider Cb. Review collected by and hosted on G2.com.

What problems is Carbon Black EDR solving and how is that benefiting you?

Many problems have been solved with Carbon Black including what I believe to be the most important - dwell time. If a breach takes 200+ days to detect, Carbon Black can assist with dropping that dwell time to far less than 1 month. The ability to decrease dwell time and detect things beyond malware is gold. Review collected by and hosted on G2.com.

Show Less

Helpful?

Admin Approval Link

Carbon Black EDR Overview

edit

What is Carbon Black EDR?

Carbon Black EDR is a market-leading incident response and threat hunting solution designed to provide responders with the most information possible, accompanied by expert threat analysis and armed with real-time response capabilities to stop attacks, minimize damage and close security gaps. Carbon Black EDR makes these teams more efficient, reducing investigations from days to hours, and more effective, enabling them to discover threats before attacks can exploit them. Carbon Black EDR also allows teams to connect to and isolate infected machines to prevent lateral movement and remediate devices without costly IT involvement. Continuous and Centralized Recording Centralized access to continuously recorded endpoint data means that security professionals have the information they need to hunt threats in real time as well as conduct in-depth investigations after a breach has occurred. Live Response for Remote Remediation With Live Response, incident responders can create a secure connection to infected hosts to pull or push files, kill processes, perform memory dumps and quickly remediate from anywhere in the world. Attack Chain Visualization and Search Carbon Black EDR provides intuitive attack chain visualization to make identifying root cause fast and easy. Analysts can quickly jump through each stage of an attack to gain insight into the attacker’s behavior, close security gaps and learn from every new attack technique to avoid falling victim to the same attack twice. Automation via Integrations and Open APIs Carbon Black boasts a robust partner ecosystem and open platform that allows security teams to integrate products like Carbon Black EDR into their existing security stack.

Carbon Black EDR Details

Discussions

Carbon Black EDR Community

Languages Supported

English

Show LessShow More

Product Description

Carbon Black EDR is an incident response and threat hunting solution designed for security teams with offline environments or on-premises requirements. Carbon Black EDR continuously records and stores comprehensive endpoint activity data, so that security professionals can hunt threats in real time and visualize the complete attack kill chain. Top SOC teams, IR firms and MSSPs have adopted Carbon Black EDR as a core component of their detection and response capability stack. Carbon Black EDR is available via MSSP or directly via on-premises deployment, virtual private cloud or software as a service.

How do you position yourself against your competitors?

Carbon Black EDR benefits security teams by providing faster end-to-end response and remediation, accelerated IR and threat hunting with continuous endpoint visibility, rapid identification of attacker activities and root cause, remote access to infected endpoints for in-depth investigation, better protection from future attacks through automated hunting, and unlimited retention and scale for the largest installations. Key capabilities include out-of-the-box and customizable behavioral detection, multiple customizable threat intel feeds, automated watchlists, process and binary search of centralized data, interactive attack chain visualization, Live Response for rapid remediation and more. Carbon Black EDR leverages the VMware Carbon Black Cloud’s aggregated threat intelligence, which is applied to the endpoint activity system of record for evidence and detection of these identified threats and patterns of behavior. Customers that augment or replace legacy antivirus solutions with Carbon Black EDR do so because those legacy solutions lack visibility and context, leaving customers blind to attacks.

Seller Details

Seller

Carbon Black

Year Founded

2002

HQ Location

Waltham, MA

LinkedIn® Page

www.linkedin.com
370 employees on LinkedIn®

Description

Carbon Black empowers top security teams to close the Risk Gap they face today. Specific directed attacks are now the cybercrime norm, and no business is exempt. There’s increasing cyber-insurance scrutiny, and government regulations continue to get stricter. In this context, security teams can no longer rely on general security platforms alone. Rather, teams must be empowered with deeper visibility and more control in order to tailor response to their unique environment. With Carbon Black, security teams have unprecedented ability to see directed attacks, contain potential impact, change policies with no user interruption, prevent repeat incidents, and measure what they stopped.

Overview Provided by:

Hope Boyer

Recent Carbon Black EDR Reviews

10/28/2024

Abhijeet K.Small-Business (50 or fewer emp.)

5.0 out of 5

"My experience with the product was great!"

The Corbon Black EDR is a powerfull cybersecurity solution designed to provide real time visibility into endpoint activities, enabling advanced thr...

10/23/2024

Verified UserMid-Market (51-1000 emp.)

4.0 out of 5

"Powerful Endpoint Visibility and Threat Hunting Tool"

Carbon Black EDR excels in presenting deep visibility into endpoint hobby, that is critical for real-time danger detection and response. The abilit...

10/21/2024

Martins O.Mid-Market (51-1000 emp.)

5.0 out of 5

"Endpoint Detection & Response (EDR) Software"

Carbon Black EDR has ability to monitors endpoint abd capture how data is processes, file execution and file paths, the network connection. It help...