We have one use case for Trellix Insights.
Provides comprehensive threat insights but needs more defensive playbooks
What is our primary use case?
What is most valuable?
We use Trellix Insights a lot for our customers. We provide it through two kinds of services: traditional support and Managed Security Service (MSS). For these clients and customers, we provide a monthly report. We use KPIs from Trellix Insights, which shows the posture of the customer's infrastructure. We use these KPIs to measure and understand the security status in the customer's infrastructure. We use this information all the time in our reports. When we have an alert and need to provide a report from an incident, we use Trellix Insights to get information to enrich the analyst's data from the incidents.
The most important benefit of Trellix Insights is its capability to integrate with EPO and provide comprehensive information. You can access the information from EPO and see the machines that have problems with vulnerabilities or out-of-date AMCore. We can drill down and access the posture, seeing the percentage of adherence. This tells me how good my infrastructure is and which machines have problems. The ability to drill down, access, and identify exactly which machine has even a small problem is the most valuable part of Trellix Insights.
What needs improvement?
For Trellix Insights, there are both positive and negative aspects. Playbooks is a very good feature. We have about 12 Playbooks, which are actions that we can implement for adjusting the infrastructure to stop threats and vulnerabilities. That's the positive aspect. However, for the defensive Playbooks, when connecting with Trellix Insights, we have only one defensive Playbook. Some customers question why there is only one. While Playbooks and defensive Playbooks serve similar purposes, in Trellix Insights, defensive Playbooks appear at the top.
It would be beneficial to have more than just one defensive Playbook. Trellix Insights has existed for many years, and since this new product was released, there has only been one defensive Playbook. This is an area that needs improvement. They need to add more defensive Playbooks quickly, considering many years have passed.
For how long have I used the solution?
The user has been using the solution for 10 years.
How was the initial setup?
The setup of Trellix Insights is easy and not complex.
What other advice do I have?
We use Trellix Insights for all clients that buy an endpoint solution. All users of endpoint solutions use Trellix Insights.
The real-time reporting capabilities of Trellix Insights for compliance management and risk assessment are good. It can improve with more campaigns and more details, but currently, it is a good source of information.
The advanced analytics in Trellix Insights are good. I needed to open a case for Trellix Insights once because there was a failure with the integration and drill-down machine information. However, this problem has not occurred again. This product is easy to maintain.
On a scale of 1-10, I rate Trellix Insights a 9.
Which deployment model are you using for this solution?
On-premises
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Microsoft Azure
