u/SlipPresent3433

Don’t change. Overwatch and complete on all domains is the way to go. Any issues you have refine with your contact

Who doesn’t and who wouldn’t?

I hear that. Crowdstrike has become massively cost efficient compared to Microsoft over the last years

AW is mostly an insurance check box and fall into the socaas bucket. You still need remediation and Ir and for more mature environments to do hunting.

Go to malpedia and you’ll find an array of threat intel.

But first ask yourself how you will use it?

Can you use procedural level data? Are you ready for that as an org? Do you still work with IOCs only for retro hunting. Check your risk profile for what kind of threat to track (what kind of supply chain threats for example) and then understand how mature your org is to process any kind of data.

Go from there. Slow build up a function where people become intel/threat informed and start using that as a starting place for detections, to cut down on detection and response, make strategic decision, build red team plans, etc

You need to escalate to whoever sold you AW. This is unacceptable

Holy cow

They are the best full stop. And they messed up. Both are true

There has been some improvement but I’m not a fan of their overall platform. The Vuln scanner is weak (just an open source scanner, their network appliance is just rule based (again open source) that misses a lot and their acquired edr is cylance.

My point: evaluate their service, not their products.

Definitely not best of breed.

Yes, too expensive at that count

Crowdstrike is the best cybersecurity company for endpoint and overwatch is the most effective threat disruption product

Your ciso was clearly tricked

Overpromising and under delivering is literally what they do

There’s loads of alternatives and many better than Arctic wolf

Time to move away from

Yep! Will keep in mind when going over next to check. The house hasn’t been occupied for 12months it’s all

Also, spot on that it’s 1930s

Yes, been unoccupied for around 16months. I’m just thinking that the leak could’ve occurred without any fix over a longer period

NDR is completely different. It’s a standalone solution providing network detection and response often paired with proprietary ai capabilities.

Arctic wolfs ndr for example is just a suricata box that was put together half baked

Sophos mdr is best bang for your buck

PS: the automation workflows are pretty neat with the paid version - you can try the license key for free for a few months I believe or at least it used to be

Bingo - self hosted is what most do. SaaS and iso27001 and all the other enterprise features is what you get for the paid version

Opencti and open source feeds is how you should start - integrate those into your Siem. Opencti normalises and structures that data and you can drive automations