The most valuable feature is the ability to see suspicious activity for devices inside my network. It helps me to quickly identify that activity and do analysis to see if it's expected or I need to mitigate that activity quickly.
Arista NDR offers a robust query language for threat activity tracking, though some users seek more user-friendly features. Security Knowledge Graph facilitates rapid data analysis, and encrypted traffic analysis aids compliance, but improvements in encrypted threat detection are needed. Endpoint identification benefits virtualized environments, and a proactive threat-hunting service utilizes expert insights. Users request STIX/TAXII IOC data import capability and better integration with multiple tools, with concerns about entity resolution reliability.
