ConnectWise SIEM vs Trellix Endpoint Detection and Response (EDR) comparison

Why PeerSpot?

ConnectWise and Trellix are both solutions in the Endpoint Detection and Response (EDR) category. ConnectWise is ranked #52 with an average rating of 6.0, while Trellix is ranked #21 with an average rating of 8.1. ConnectWise holds a 0.9% mindshare in EDR, compared to Trellix’s 1.0% mindshare. Additionally, 66% of ConnectWise users are willing to recommend the solution, compared to 85% of Trellix users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Sep 9, 2024

Trellix Endpoint Detection and Response and ConnectWise SIEM are both highly regarded tools in the cybersecurity marketplace. Trellix EDR stands out for its ease of use and robust support, whereas ConnectWise SIEM takes an upper hand with its comprehensive feature set and perceived value.

Features: Trellix EDR is valued for its threat detection, automated response capabilities, and the efficiency it brings to security teams. ConnectWise SIEM has extensive integrations, real-time monitoring features, and scalability. Users note its customizability, adding to its feature completeness over Trellix EDR.

Room for Improvement: Trellix EDR can improve in reporting and alert accuracy, with some seeking more detailed analytics. ConnectWise SIEM users prefer a more intuitive configuration process, enhanced customer support experience, and fewer setup issues.

Ease of Deployment and Customer Service: Trellix EDR has a straightforward deployment process and responsive customer service. ConnectWise SIEM offers a more complex deployment, but the robust support system offsets initial setup issues. Trellix's easier use and faster implementation time are strong points against ConnectWise's intricate setup.

Pricing and ROI: Trellix EDR offers competitive pricing with good ROI due to its effective protection mechanisms. ConnectWise SIEM is more expensive initially but is considered worth the investment for its long-term benefits and comprehensive features. Users favoring ROI tend to prefer ConnectWise SIEM despite the higher cost.

To learn more, read our detailed ConnectWise SIEM vs. Trellix Endpoint Detection and Response (EDR) Report (Updated: September 2026).

Buyer's Guide

ConnectWise SIEM vs. Trellix Endpoint Detection and Response (EDR)

September 2026

Download the complete report

Helped 920,929 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex XDR by Palo Alto Net...

Mindshare comparison

As of November 2026, in the Endpoint Detection and Response (EDR) category, the mindshare of Cortex XDR by Palo Alto Networks is 3.8%, down from 3.8% compared to the previous year. The mindshare of ConnectWise SIEM is 0.9%, up from 0.3% compared to the previous year. The mindshare of Trellix Endpoint Detection and Response (EDR) is 1.0%, down from 1.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Endpoint Detection and Response (EDR) Mindshare Distribution
Product	Mindshare (%)
Cortex XDR by Palo Alto Networks	3.8%
Trellix Endpoint Detection and Response (EDR)	1.0%
ConnectWise SIEM	0.9%
Other	94.3%

Endpoint Detection and Response (EDR)

Featured Reviews

ABHISHEK_SINGH

Senior Process Expert at A.P. Moller - Maersk

Gained full visibility and streamlined threat detection through behavior-based insights and AI integration

Initially, we got to have a lot of false positives when we onboarded, but nowadays it's quite smooth. We have fine-tuned our security policies and allowed different levels of policies to get rid of those false positives. Currently, we are getting a fairly good amount of incidents that are not false positives or benign, but actionable items. The process is streamlined. In the initial days, the operations used to get involved in a lot of benign and other activities, but now the process is streamlined. We are leveraging the auto-detection and remediation plans. The operations teams are now more involved in other business roles as well, not just looking into the logs and fetching out what's happening there. They have fixed a lot of things. Initially, they didn't have IAC code drift detection, cloud posture management, or security posture management, but they have those now. They purchased different vendors and did a merger with that. They have now Prisma Cloud that gets integrated and now they are working with Cortex Cloud. Everything that was negative has now been addressed, and the product altogether looks to be in a very better and mature shape now. Currently, it's more or less detecting the workloads with AI-based best practices. Since most organizations are consuming AI agents and other things, we are looking forward to seeing what other feature enhancements Palo Alto can support in that.

Read full review

reviewer2711757

Cyber Security Software Engineer at a tech services company with 11-50 employees

Automated alerting and reporting excel while cost and feature limitations remain

I find automation to be one of the best and most valuable features of the product. Machine learning is incorporated into the solution, though AI is a broader term that I wouldn't apply here. I haven't personally explored AI yet, but I will investigate it. Machine learning functions more as automation in my experience, as there's no training involved yet. I want to conduct R&D on another project with Wazuh to determine how to capture usage, for example, tracking user logins and time spent. This is where I need to implement machine learning. Additionally, the extraction of GeoIP adds complexity. The solution is effectively reducing incident response times in operations.

Read full review

CESARCASTRO

Committee Of IT Cybersececurity at a energy/utilities company with 51-200 employees

Cross-site threat hunting has improved visibility and supports proactive incident response

I believe this is a product in evolution. I do not think it is a final tool to conduct forensics or information forensics of the incidents or information incidents that could arise in our network infrastructure. Trellix Endpoint Detection and Response (EDR) is interesting and is a very good entry point that has been evolving through the last years. In the next two months, I have a new contract, and we are pointing out to have an XDR solution with NDR and EDR together. I do not have enough time to do it because I am the manager. However, my coworkers do not understand it yet. I have a contract with a third-party company that is making reports around that, but also they do not have enough experience or enough utility of this. It would be interesting if I have a notification system from EDR. For example, if I am the manager, it would be interesting to have a warning, alarm, or something around that which could call me to get into the system and the dashboard to see what is happening. For example, if it is a high-level threat. However, most of them are just advisory or warnings. I do not enter the tool frequently. I guess I access it once every three months.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I can highlight that we have not faced any security incidents with Cortex XDR by Palo Alto Networks, and even though our environment is quite dynamic, we have not faced any security incident with Cortex XDR by Palo Alto Networks until now."

"It can automatically correlate events and logs, which is very helpful for an IT administrator. It can correlate different kinds of malware activities over a network, agent, or host system. You do not need to do it manually. It is a good feature. It is also a user-friendly solution. We have deployed it on the cloud because our space does not provide any flexibility for on-premises deployment, but Palo Alto has added some flexibility to install it on-premises. It must be like the same Cortex XDR agent for all the VPN services, web filtering services, and everything else."

"The scalability of Cortex XDR by Palo Alto Networks is very good."

"The protection offered by this product is good, as is the endpoint reporting."

"Threat identification and detection are the most valuable features of this solution."

"If any application performs suspicious activities, such as changing registries or modifying other applications, Cortex XDR detects and blocks the entire application."

"Traps pays for itself within the first 16 months of a three-year subscription."

"It detected stuff that other things wouldn't detect."

More Cortex XDR by Palo Alto Networks pros

"The integration capabilities of ConnectWise SIEM are off the shelf, making it easy to buy and use; you just unpack it and use it."

"One valuable feature of ConnectWise Fortify is the ability to add other teams and receive notifications when customers make changes or remove multi-factor authentication in Microsoft or SAP environments."

"We have found the solution has great functionality and it is easy to use."

"Trellix Endpoint Detection and Response (EDR) is valuable because we have a Wide Area Network with many sites, and the EDR is cross-site since it is installed and managed from the cloud."

"Trellix has done a good job reducing threats."

"It is a stable solution. Stability-wise, I rate the solution a nine out of ten...I rate the solution's technical support team a nine and a half or ten out of ten."

"The investigation and rule detection feature of the solution has proven most useful for our company"

"What we're using the most and what we found valuable in McAfee MVISION Endpoint Detection and Response are Web Control, Advanced Threat Protection, and Threat Prevention features."

"The most valuable feature I found in McAfee MVISION Endpoint Detection and Response is the guided analytics or guided EDR investigation."

"The biggest strength of the solution is that it's an integrated product that includes EDR and antivirus."

"The product's initial setup phase was very straightforward since you just need to install it, and it works."

More Trellix Endpoint Detection and Response (EDR) pros

Cons

"While using Cortex, I noticed some aspects that could be improved, such as increasing the synchronization speed between XDR and Xnor."

"However, if you do not have Palo Alto in your environment, you are paying these additional services just for Cortex XDR by Palo Alto Networks, so it is not a cost-effective solution."

"A little bit more automation would be nice."

"There's an overall lack of features."

"The solution should offer more dashboards and they should be better customized."

"The solution could improve by providing better integration with their own products and others."

"When it comes to malware files, it should be a little quick because, at times, it would give a wrong result in the sense of what it might be on malware, even if it still might be a normal one."

"The deployment is pretty hard."

More Cortex XDR by Palo Alto Networks cons

"The manage portion of the solution is complicated and should be simplified by having different versions to meet the needs of different size companies."

"ConnectWise SIEM is primarily focused on notifications and is limited in that aspect, while Wazuh can automate the elimination process."

"ConnectWise Fortify could work on covering more areas, like phishing messages, which have become more complicated to detect."

"The solution's downside stems from the fact that Trellix Endpoint Detection and Response (EDR) and McAfee MVISION Endpoint are not combined into a single solution, so from an improvement perspective, they need to be combined into a single solution."

"The graphical view for nodes must be increased."

"Initially, I was using it on servers, but it consumes a lot of resources on servers."

"The endpoints and utilization are too high, which impacts the production activity."

"I'd like the tool to become more like an XDR, with one management system and endpoint activation."

"I remember doing many tickets for Trellix support, and my EDR was not properly functioning. I didn't feel the detection or the real protection."

"I also think performance needs improvement, especially for servers, as the Trellix HX module uses high CPU, scans constantly, and negatively impacts the performance for our clients' users or our servers."

"The main drawbacks are resources and processing time, as it consumes a lot of CPU and RAM."

More Trellix Endpoint Detection and Response (EDR) cons

Pricing and Cost Advice

"The pricing is okay, although direct support can be expensive."

"We didn't have to pay any additional fee for the cloud instance. It just came with the renewal, which was nice."

"Every customer has to pay for a license because it doesn't work with what you get from a managed services provider."

"The pricing seems fair, and I do like the licensing model. You use wherever they are, and it is elastic."

"Cortex XDR’s pricing is very reasonable."

"It is "expensive" and flexible."

"I feel it is fairly priced."

"The price of the product is not very economical."

More Cortex XDR by Palo Alto Networks pricing and cost advice

"The solution is expensive."

"Pricing for McAfee MVISION Endpoint Detection and Response is not that expensive, but it's not something that a startup could buy. Pricing for it is for midsized businesses. There's an additional payment if you want data retention for more than thirty days. They gave us data retention for thirty days. Then if you want longer data retention, they have the paid option for a three-month data retention period and for a one-year data retention period."

"The pricing is always high."

"Pricing is a problem in South Africa. It could be cheaper here. The rand-to-dollar exchange rate makes it expensive for us. A 25 dollar endpoint cost becomes quite significant when converted to rand."

"On a scale of one to ten, where one is low and ten is high, I rate the solution's pricing an eight out of ten."

"The licensing costs attached to the solution are very easy to manage. There is a need to make yearly payments towards the licensing costs."

"McAfee MVISION Endpoint Detection and Response is reasonable in terms of cost. It's a tool my company has been using for a few years now. It costs $25,000 to $30,000 for six hundred users."

"The cost is okay, compared to other products."

"The price is reasonable."

More Trellix Endpoint Detection and Response (EDR) pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Endpoint Detection and Response (EDR) solutions are best for your needs.

See recommendations

920,929 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Comms Service Provider

14%

Outsourcing Company

12%

Construction Company

10%

Manufacturing Company

10%

Comms Service Provider

11%

Construction Company

11%

Computer Software Company

Outsourcing Company

Financial Services Firm

14%

Outsourcing Company

Construction Company

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	50
Midsize Enterprise	21
Large Enterprise	57

No data available

By reviewers
Company Size	Count
Small Business	17
Midsize Enterprise	3
Large Enterprise	14

Questions from the Community

Cortex XDR by Palo Alto vs. Sentinel One

Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...

See all answers

Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)

Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...

See all answers

How is Cortex XDR compared with Microsoft Defender?

Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...

See all answers

What needs improvement with ConnectWise Fortify?

I haven't utilized the advanced threat intelligence capabilities with ConnectWise SIEM. Advanced threat intelligence ...

See all answers

What is your primary use case for ConnectWise Fortify?

I do not have experience with ConnectWise SIEM for RMM, as I mostly work on Wazuh, and I have a team that handles Con...

See all answers

What advice do you have for others considering ConnectWise Fortify?

The review can be made anonymous if just my name and not the company name is used. I would assess the real-time visib...

See all answers

What is your experience regarding pricing and costs for McAfee MVISION Endpoint Detection and Response?

My experience with pricing, implementation costs and platform licensing has been positive. The solution offers a robu...

See all answers

What needs improvement with McAfee MVISION Endpoint Detection and Response?

Although Trellix Endpoint Detection and Response (EDR) offers those detection, investigation and response capabilitie...

See all answers

What is your primary use case for McAfee MVISION Endpoint Detection and Response?

The main use case for Trellix Endpoint Detection and Response (EDR) in my organization is for continuous monitoring o...

See all answers

Comparisons

Microsoft Defender for Endpoint vs Cortex XDR by Palo Alto Networks

Compared 16% of the time

SentinelOne Singularity Endpoint vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

CrowdStrike Falcon vs Cortex XDR by Palo Alto Networks

Compared 4% of the time

Symantec Endpoint Security vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

Cortex XSIAM vs Cortex XDR by Palo Alto Networks

Compared 3% of the time

More Cortex XDR by Palo Alto Networks Competitors

Zscaler Zero Trust Exchange Platform vs ConnectWise SIEM

Compared 6% of the time

CompassOne by Blackpoint Cyber vs ConnectWise SIEM

Compared 5% of the time

Check Point Harmony SASE (formerly Perimeter 81) vs ConnectWise SIEM

Compared 5% of the time

Wazuh vs ConnectWise SIEM

Compared 4% of the time

iboss vs ConnectWise SIEM

Compared 1% of the time

More ConnectWise SIEM Competitors

Trellix Endpoint Security Platform vs Trellix Endpoint Detection and Response (EDR)

Compared 10% of the time

CrowdStrike Falcon vs Trellix Endpoint Detection and Response (EDR)

Compared 8% of the time

Trellix Active Response vs Trellix Endpoint Detection and Response (EDR)

Compared 5% of the time

TrendAI Vision One vs Trellix Endpoint Detection and Response (EDR)

Compared 4% of the time

Cisco Secure Endpoint vs Trellix Endpoint Detection and Response (EDR)

Compared 2% of the time

More Trellix Endpoint Detection and Response (EDR) Competitors

Product Reports

Buyer's Guide

Cortex XDR by Palo Alto Networks

October 2026

Download Cortex XDR by Palo Alto Networks product report

Buyer's Guide

Security Information and Event Management (SIEM)

October 2026

Download ConnectWise SIEM product report

Buyer's Guide

Trellix Endpoint Detection and Response (EDR)

October 2026

Trellix Endpoint Detection and Response (EDR) report

Download Trellix Endpoint Detection and Response (EDR) product report

Also Known As

Cyvera, Cortex XDR, Palo Alto Networks Traps

ConnectWise Security Management, ConnectWise Fortify, Continuum Fortify, ConnectWise SIEM, ConnectWise SASE

McAfee MVISION EDR, MVISION EDR, MVISION Endpoint Detection and Response

Overview

Cortex XDR by Palo Alto Networks provides advanced threat detection with AI-driven endpoint protection and seamless integration, ensuring multi-layered security and automatic threat response.

Cortex XDR is designed to safeguard endpoints against malware and suspicious activities. It offers advanced threat detection and response capabilities using behavioral analysis, AI, and machine learning. It seamlessly integrates with security infrastructures, providing endpoint security, firewall integration, and enhanced visibility in both cloud-based and on-premises environments.

What are the key features of Cortex XDR?

Advanced Threat Detection: Uses AI and machine learning for proactive threat identification.
Multi-layered Security: Combines various security measures for comprehensive protection.
Endpoint Protection: Safeguards against malware and exploits.
Behavioral Analysis: Monitors suspicious activity for early detection.
Automatic Threat Response: Automates responses to neutralize threats.

What benefits should users expect?

Ease of Use: Simplifies security management with intuitive design.
Resource Efficiency: Minimizes impact on system resources.
Integration Capabilities: Works well with existing security setups.
Reduced Analyst Workload: Automates processes to decrease manual intervention.

Organizations in diverse sectors deploy Cortex XDR to protect against malware, leveraging its advanced threat detection capabilities. Its integration with existing security infrastructures appeals to those seeking comprehensive protection in both cloud and on-premises environments, providing enhanced visibility and threat intelligence.

Palo Alto Networks

ConnectWise SIEM is a cybersecurity platform designed to enhance threat detection and response capabilities, integrating seamlessly into sophisticated IT infrastructures.

Developed to address complex cybersecurity challenges, ConnectWise SIEM offers robust monitoring and analytics, enabling businesses to detect threats faster and with greater accuracy. It combines security information and event management with advanced intelligence to create a comprehensive security solution that supports real-time analysis and immediate action.

What are the most important features of ConnectWise SIEM?

Advanced Threat Detection: Leverages machine learning to identify potential threats quickly.
Real-Time Alerts: Provides instant notifications to ensure swift response to incidents.
Comprehensive Reporting: Delivers detailed insights to inform decision-making.
Scalability: Adapts to the growing needs of any organization.
Seamless Integration: Connects effortlessly with existing IT tools and platforms.

What benefits or ROI should users look for in reviews?

Reduced Downtime: Minimizes disruptions with proactive threat management.
Cost Efficiency: Lowers overall security expenditure through strategic resource allocation.
Improved Compliance: Assists in meeting industry regulations with comprehensive logs and reports.
Enhanced Security Posture: Strengthens defenses with continuous monitoring and analysis.

ConnectWise SIEM is widely implemented in industries such as finance, healthcare, and retail, where data security is crucial. These sectors benefit from its capability to handle large volumes of data while maintaining regulatory compliance. Its flexibility allows customization to meet specific industry requirements, providing targeted security solutions to protect sensitive information.

ConnectWise

Trellix Endpoint Detection and Response (EDR) offers advanced threat detection using AI-driven analytics, real-time monitoring, and integration with the MITRE Framework, enhancing security through comprehensive detection and response features.

Trellix EDR provides users with tools for threat hunting, powerful forensic capabilities, and intuitive dashboards. It integrates with diverse systems and supports cloud-based multi-site configurations, which facilitates a more robust security posture. With features like effective quarantine measures, behavior monitoring, and automation, it enhances operational efficiency. Despite its strengths, areas for refinement include better AI-driven threat analysis, improved resource efficiency, and faster processing times. Enhancing detection capabilities for unknown threats and improving integration with other tools can significantly upgrade performance and usability.

What features define Trellix EDR?

Advanced Threat Detection: Leverages AI analytics for comprehensive threat identification.
Threat Hunting: Empowers users to proactively search for threats.
Real-Time Monitoring: Provides immediate insights into security incidents and status.
Integration with MITRE Framework: Ensures thorough detection and response alignment.
Forensic Capabilities: Offers tools for detailed investigation of security events.
Cloud-Based Support: Facilitates configuration for multi-site environments.

What benefits can users expect?

Enhanced Threat Intelligence: Improved detection capabilities for seamless integration with SIEM systems.
Operational Efficiency: Automation and intuitive dashboards increase productivity.
Robust Risk Management: Comprehensive protection against advanced threats such as ransomware.
Zero Trust Compliance: Telemetry visibility aligns with compliance standards.

Trellix EDR is widely implemented in industries for endpoint protection and incident response. It helps protect workstations and improve threat intelligence by supporting integrations with cloud security and SIEM. Users benefit from its ability to identify malicious files and ransomware while adhering to zero-trust principles through improved telemetry visibility.

Trellix

Sample Customers

CBI Health Group, University Honda, VakifBank

Techvera, Syrex, Clark Integrated Technologies

Sutherland Global Services

Buyer's Guide

ConnectWise SIEM vs. Trellix Endpoint Detection and Response (EDR)

September 2026

Free Report: ConnectWise SIEM vs. Trellix Endpoint Detection and Response (EDR)

Find out what your peers are saying about ConnectWise SIEM vs. Trellix Endpoint Detection and Response (EDR) and other solutions. Updated: September 2026.

DOWNLOAD NOW

920,929 professionals have used our research since 2012.

See our ConnectWise SIEM vs. Trellix Endpoint Detection and Response (EDR) report.

See our list of best Endpoint Detection and Response (EDR) vendors.

We monitor all Endpoint Detection and Response (EDR) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.