Arbor DDoS vs Trellix Network Detection and Response comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Arbor DDoS
Average Rating
8.6
Number of Reviews
46
Ranking in other categories
Distributed Denial of Service (DDOS) Protection (2nd)
Trellix Network Detection a...
Average Rating
8.4
Number of Reviews
38
Ranking in other categories
Advanced Threat Protection (ATP) (9th), Network Detection and Response (NDR) (7th)
 

Featured Reviews

Sobhakant Dhungana - PeerSpot reviewer
May 18, 2023
A stable solution offering features like analytics and attack mitigation capabilities
Arbor DDoS is not used for enterprise companies but by some other companies, including NIDC, a government entity Analytics and its attack mitigation capabilities are valuable features of the solution. It is an expensive product, so there is room for improvement in terms of pricing. I work for…
BiswabhanuPanda - PeerSpot reviewer
Apr 4, 2024
Offers in-depth investigation capabilities, integrates well and smoothly transitioned from a lower-capacity appliance to a higher one
The in-depth investigation capabilities are a major advantage. When the system flags something as malicious, it provides a packet capture of that activity within the environment. That helps my team quickly identify additional context that most other tools wouldn't offer – like source IP or base64 encoded data. We can also see DNS requests and other details that aren't readily available in solutions like Check Point or others that we've tried. The detection itself is solid, and their sandboxing is powerful. There's a learning curve – you need a strong grasp of OS-level changes, process forking, registry changes, and the potential impact of those. But with that knowledge, the level of information Trellix provides is far greater than what we've seen elsewhere. The real-time response capability of Trellix has been quite effective, although it's not very fast. The key is this solution's concept of 'preference zero.' They don't immediately act on a zero-day. For example, the solution has seen a piece of malware for the first time. It'll let it in, then do sandboxing. Maybe after four or five minutes, it identifies that specific file's DNX Secure Store as malicious. At that point, they update the static analysis engine, and it gets detected if anything else tries to download the same file. There is that initial 'preference zero' concept, like with Panda. You may not hold traffic in the network. That's standard in the industry; we don't do much about it. To address that, we also have endpoint solutions. We use SentinelOne in our environment, which helps us identify threats like Western Bureaus and others.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We also use it by serving our customers' cloud signaling services with on-premise APS devices."
"The stateless device format means that the box is very strong for preventing DDoS attacks."
"Arbor DDoS's best feature is that we can put the certificates in, and it will look at layer seven and the encrypted traffic and do the required signaling."
"We use it not only for DDoS detection and protection, but we also use it for traffic analysis and capacity planning as well. We've also been able to extend the use of it to other security measures within our company, the front-line defense, not only for DDoS, but for any kind of scanning malware that may be picked up. It's also used for outbound attacks, which has helped us mitigate those and lower our bandwidth costs..."
"In the GUI, the packet capture is a very good option, as is the option to block an IP address."
"The solution provides good protection against volumetric DDoS attacks."
"It is fully mitigating the attacks. We've dealt with other ones where we didn't necessarily see that. The detection is very good. It's also very simple to use. Arbor is a single pane of glass, whereas with other solutions you might have a detection pane of glass and then have to go to a separate interface to deal with the mitigation. That single pane of glass makes it much simpler."
"Arbor DDoS offers security features that automatically detect and prevent DDoS attacks."
"It protects from signature-based attacks and signature-less attacks. The sandboxing technology, invented by FireEye, is very valuable. Our customers go for FireEye because of the sandboxing feature. When there is a threat or any malicious activity with a signature, it can be blocked by IPS. However, attacks that do not have any signatures and are very new can only be blocked by using the sandboxing feature, which is available only in FireEye. So, FireEye has both engines. It has an IPS engine and a sandbox engine, which is the best part. You can get complete network protection by using FireEye."
"The most valuable feature is MVX, which tests all of the files that have been received in an email."
"The installation phase was easy."
"We see ROI in the sense that we don't have to react because it stops anything from hurting the network. We can stop it before we have a bigger mess to clean up."
"The scalability has not been a problem. We have deployed the product in very high bandwidth networks. We have never had a problem with the FireEye product causing latency issues within our networks."
"Application categorization is the most valuable feature for us. Application filtering is very interesting because other products don't give you full application filtering capabilities."
"Before FireEye, most of the times that an incident would happen nobody would be able to find out where or why the incident occurred and that the system is compromised. FireEye is a better product because if the incident already happened I know that the breach is there and that the system is compromised so we can take appropriate action to prevent anything from happening."
"The solution can scale."
 

Cons

"An improvement to Arbor DDoS would be to make evaluation licenses and virtual machines available."
"The implementation should be made easier."
"I would also like more visibility into their bad actor feeds, their fingerprint feeds. We try to be good stewards of the internet, so if there are attacks, or bad actors within our networks, if there were an easier way for us to find them, we could stop them from doing their malicious activity, and at the same time save money."
"The product could have end-to-end platform visibility."
"I think the diversity of protection is extremely limited. It must be expanded in future upgrades and versions."
"Arbor Pravail APS devices do not sync features or config the backup enough. This needs to be improved."
"Arbor DDoS could improve out-of-the-box reporting, it could be better."
"A small improvement could be a better reporting system."
"It is an expensive solution."
"Improvements could be achieved through greater integration capabilities with different firewall solutions. Integrating with the dashboard itself for different firewalls so users can also pull tags into their firewall dashboard."
"The problem with FireEye is that they don't allow VM or sandbox customization. The user doesn't have control of the VMs that are inside the box. It comes from the vendor as-is. Some users like to have control of it. Like what type of Windows and what type of applications and they have zero control over this."
"Certain features in Trellix Network Detection and Response, such as using AL-type commands, may initially pose a challenge for those unfamiliar with such commands. However, once users become accustomed to the system, it becomes easier to use."
"If you want to search the hashes in the environment, you need to put in IOCs one by one, making it a very hectic job."
"Technical support could be improved."
"A better depth of view, being able to see deeper into the management process, is what I'd like to see."
"The world is currently shifting to AI, but FIreEye is not following suit."
 

Pricing and Cost Advice

"The pricing of the solution is cheap."
"Arbor's products are very expensive. Their competitors are cheap when compared with Arbor."
"Pricing is slightly on the higher side."
"As far as I know, they are the best in this sector, in DDoS protection. They know it, I know, because their service prices are too high. They provide cloud DDoS protection for ISPs, but that is also too expensive."
"I believe that the price of Arbor DDoS falls under the bracket of medium to high price."
"Arbor DDoS is quite expensive, but all these solutions are expensive because they deal with confidential information."
"I don't deal with the pricing, but it seems that you need to get basic support in order to upgrade the software and implement some patches."
"We do not use the Arbor Cloud DDoS solution because it is too costly."
"The pricing is a little high."
"It's an expensive solution."
"The user fee is not as high but the maintenance fee is expensive."
"When you purchase FireEye Network Security NX, will need to purchase a megabit per second package. You must know your needs from day one."
"The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced."
"The tool is a bit pricey."
"Its price is a bit high. A small customer cannot buy it. Its licensing is on a yearly basis."
"There are some additional services that I understand the vendor provides, but our approach was to package all of the features that we were looking to use into the product."
report
Use our free recommendation engine to learn which Distributed Denial of Service (DDOS) Protection solutions are best for your needs.
787,383 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Computer Software Company
17%
Comms Service Provider
8%
Government
7%
Financial Services Firm
17%
Computer Software Company
9%
Manufacturing Company
8%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
I would say if it’s an ISP that will build a scrubbing center, Netscout/Arbor is a good solution. In all other solutions, Imperva is a great choice.
Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?
Arbor would be the best bid, apart from Arbor, Palo Alto and Fortinet have good solutions. As this is an ISP, I would prefer Arbor.
What do you like most about Arbor DDoS?
The quality of the technical support provided by Arbor DDoS is premium.
What do you like most about FireEye Network Security?
We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. With Trellix, we easily confirmed that there was no lateral network involvement an...
What is your experience regarding pricing and costs for FireEye Network Security?
The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced. It's a bit on the expensive side, but we don't want to compromise with cheap, less r...
What needs improvement with FireEye Network Security?
The analytics could be better. It seems heavily influenced by the McAfee and FireEye integration, and that integration still isn't seamless. STG needs to... I'm not sure what their roadmap is; they...
 

Also Known As

Arbor Networks SP, Arbor Networks TMS, Arbor Cloud for ENT
FireEye Network Security, FireEye
 

Learn More

Video not available
 

Overview

 

Sample Customers

Xtel Communications
FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems
Find out what your peers are saying about Cloudflare, NETSCOUT, Akamai and others in Distributed Denial of Service (DDOS) Protection. Updated: May 2024.
787,383 professionals have used our research since 2012.