Most Helpful Review
Gives us the capabilities of a Tier 4 analyst without hiring one; at a glance we can see what's happening in our...
Researched Darktrace but chose Darktrace: A great solution for threat detection that intelligently and immediately responds to attacks across your enterprise system
We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
Other solutions will say, "Hey, this device is doing something weird." But they don't aggregate that data point with other data points. With Awake you have what's called a "fact pattern." For example, if there's a smart toaster on the third floor that is beaconing out to an IP address in North Korea, sure that's bizarre. But if that toaster was made in North Korea it's not bizarre. Taking those two data points together, and automating something using machine-learning is something that no other solution is doing right now.
The query language makes it easy to query the records on the network, to do searches for the various threat activities that we're looking for. The dashboard, the Security Knowledge Graph, displays information meaningfully and easily. I am able to find the information that I want to find pretty quickly.
The most valuable feature is the ability to see suspicious activity for devices inside my network. It helps me to quickly identify that activity and do analysis to see if it's expected or I need to mitigate that activity quickly.
Its most valuable feature is its ability to identify malicious connected IPs from outside and the attacks that get through to the inside.
The Dynamic Threat Dashboard is very nice, as it lists all of your threats and rates them, and then you can choose whether to investigate further.
The solution is stable. We've never had any problems with it.
The most valuable aspect of this solution is that it has very efficient search functionality.
A simple, powerful AI solution that just does all the work for you when you turn it on.
Darktrace is extremely stable.
What I like about Darktrace, is that you can quickly identify threats.
The most valuable feature is the alerts. The alerts are meaningful. The event rolls up into meaningful and actionable alerts rather than just being noise.
It helps us determine what is going on with our Internet and who is hogging it all up. If we get a real high throughput or a throughput that's going over and getting dropped fairly quickly, we can tell who (or what device) is consuming that traffic.
Visualization of the network traffic is the most valuable feature. It allows you to drill into information quite quickly.
The solution helps to enrich the data context of our network traffic. It allows me to see what applications are most in use on a slightly historical basis, going back a day or week at tops. It allows me to tune QoS or traffic shaping around what's being used. It saves me from having to unnecessarily upgrade, if I don't need to.
We have had many requests to understand in the network which devices are connected to others. Most people don't have this information or are able to establish a map of data flow everywhere around the network. Scrutinizer can really help with this. We are using it to understand who is talking to what, how, and which protocols can help us to improve security and analyze flow.
It shows us the saturation of the network of devices. It gives us a clear view of the flows in the network to understand, for instance, planning upgrades in the network to get an idea of what's going on the network on traffic flows. It gives us insight, for instance, on what's going on on our VPN Client. There are a lot of things where it provides very helpful information. It also gives us our security reports with quite detailed information on what's going on in the network, and whether there are data exfiltrations and so on.
As a network engineer, the ability to identify what traffic on the link is consuming all the bandwidth at any given time, and provide immediate feedback to the business, is the most valuable feature.
The reporting and generating troubleshooting reports would be the best feature; our host-to-host conversation reporting.
It's agnostic as far as what your network gear is. As long as it supports an sFlow, JFlow, NetFlow, some kind of flow monitoring, Plixer will support it very well.
I would like to see a bit more in terms of encrypted traffic. With the advent of programs that live off the land, a smart attacker is going to leverage encryption to execute their operation. So I would like to see improvements there, where possible. Currently, we're not going to be decrypting encrypted traffic. What other approaches could be used?
I enjoy the query language, but it could be a bit more user-friendly, especially for new users who come across it... They should push it more into a natural language style as opposed to a query language.
There's room for improvement with some of the definitions, because I don't have time and I'm not a Tier 4 analyst. I believe that is something they're working towards.
Darktrace needs to automate the reports of false positives, botnets and everything.
This is quite an expensive product so the pricing is something that can be improved.
The solution would benefit from automation. Currently, you have to know what you are searching for.
Tracing and correlation of events could be improved.
It could build in integrations for some complementary products, but it has an assistant plugin so this is not really a big deal.
Darktrace does not have any capabilities to configure.
The program is quite expensive.
I would like for the product to work on the endpoints as well. I would like to see enhanced visibility into the endpoints and network but this solution only sits on the network itself.
I wish the reporting side was easier to work with, but it does a decent job. I also wish the reporting side was a little more intuitive or they offered more reporting examples.
It would be useful if there was a way to back up the configuration information. E.g., if you wanted to deploy a new instance or disaster recovery, you could quite easily deploy and restore the config, as opposed to having to restore all the NetFlow data. If there was just a button that said "backup config information", that would be good.
The visual acuity of how it presents data can sometimes be confusing. It takes a bit for people to spin up how to look at the graphs.
For updating the Scrutinizer platform, when we have the actual data, it never happens in one day. Every time we have the data, we are obliged to install a new server in order to integrate the old data, and every time it has a problem. Most of the time, we were obliged to scrap all the data because we couldn't transfer it to the new server. So, it would be very good if they could improve this part.
Data retention needs improvement. Data retention is a thing where we are looking for a better way to collect flow data for a longer time to do forensic research on security incidents. By default, data retention is quite low. We need detailed data in safe storage for a longer time, e.g., for a couple of months. An improvement would be a way to export data into a secure long-term storage.
There is room for improvement around the data that they have on the website about solutions... they should have more templated solutions on their website. Going out and identifying how to do RTP performance with a Cisco router, or how to do application response times in an Arrista data center deployment was where most of the work was... They should spend some more time documenting solutions and putting together white papers.
Knowing that they're coming out with a new user interface, that is an area where there is room for improvement. There are so many variables. They should limit the variables in the user interface and create some classes, like "simple," "novice," and "expert" to narrow down the variables within it.
They're working on the security areas, so it can provide more insight. What they have is still pretty much IP-concentric. If they were to make it IP and URL, they'd be a little bit ahead on that.
Pricing and Cost Advice
Information Not Available
It is inexpensive considering what it can do and the competition.
There are no extra costs. It's about $8,000 a year. The bang for the buck (cost) is definitely a plus.
We have increased the license over time. We have added more licenses as the network has grown.
There is a recurring maintenance fee after the initial purchase or if we want the license upgrade.
The license is per device. We have 50 devices.
We just renewed. The pricing is 5,000 euro per year. This is the final price. All tax (20 percent) is included.
We recently bought a license upgrade, so we will integrate more exporters. We upgraded from a 25 exporter license to a 50 exporter license. Therefore, there will be more flows, and this will be an extension. I don't know when we will purchase a faster server, because the server that we have is quite new.
It's about €10,000 a year for initial license and yearly maintenance costs. In addition, the hardware costs are about €10,000 once every five years.
We pay our one-off cost for the licenses, per device, in blocks of 50. And then we pay an annual maintenance fee of about $15,000 Australian, which is, at this point in time, about $9,000 US, for those 250 devices. The upfront costs for the 250-license use, were about $50,000 Australian, which is about $32,000 US.
Compared 63% of the time.
Compared 20% of the time.
Compared 9% of the time.
Compared 19% of the time.
Compared 9% of the time.
Compared 6% of the time.
Compared 22% of the time.
Compared 17% of the time.
Compared 13% of the time.
Also Known As
Awake Security is the only advanced network traffic analysis company that delivers a privacy-aware solution capable of detecting and visualizing behavioral, mal-intent and compliance incidents with full forensics context. Powered by Ava, Awake’s security expert system, the Awake Security Platform combines federated machine learning, threat intelligence and human expertise. The platform analyzes billions of communications to autonomously discover, profile and classify every device, user and application on any network. Through automated hunting and investigation, Awake uncovers malicious intent from insiders and external attackers alike. The company is ranked #1 for time to value because of its frictionless approach that delivers answers rather than alerts.
Darktrace is the world’s leading machine learning company for cyber security.
Created by mathematicians from the University of Cambridge, Darktrace’s Enterprise Immune System uses AI algorithms that mimic the human immune system to defend enterprise networks of all types and sizes.
Our self-learning approach is the first non-consumer application of machine learning to work at scale, across all network types, from physical, virtualized, and cloud, through to IoT and industrial control systems.
By applying its unique, unsupervised machine learning, Darktrace has identified 30,000 previously unknown threats in over 2,000 networks, including zero-days, insider threats and subtle, stealthy attacks.
The Scrutinizer incident response system leverages network traffic analytics to provide active monitoring, visualization, and reporting of network and security incidents. The system quickly delivers the rich forensic data needed by IT professionals to support fast and efficient incident response.
Identify hidden network threats
Learn more about Darktrace
Learn more about Plixer Scrutinizer
|Coming Soon...||Irwin Mitchell, Open Energi, Wellcome Trust, FirstGroup plc, Virgin Trains, Drax, QUI! Group, DNK, CreaCard, Macrosynergy, Sisley, William Hill plc, Toyota Canada, Royal British Legion, Vitol||Oxford Networks, Squaw Valley Ski Holdings, UltiSat, Wipro, West Aurora School District 129, SUNY Geneseo College, Bloomington Public Schools, First National Bank of Pennsylvania, Kitsap Credit Union, Metropolitan Transit Authority of Harris County Houston Texas, Carilion Clinic, Banner Health, IDEXX Laboratories, Phibro Animal Health Corporation, Goodwill Industries, Parmalat, Armstrong Coal Company, Flybe, James Walker|
Software R&D Company20%
Comms Service Provider13%
Financial Services Firm8%
Software R&D Company26%
Comms Service Provider14%
Financial Services Firm29%
Software R&D Company35%
Financial Services Firm20%