The best in the market(provide proactive detections based on Behaviour and silent threats on the endpoints) Review collected by and hosted on G2.com.

The Alerting part can be customized (So that the analyst can create custom rules more creative and detect insider threats and PUPs) Review collected by and hosted on G2.com.

This has one of the best correlation mechanics which enables Cb to fetch data from various sources and that too very precisely categorized. Review collected by and hosted on G2.com.

Defensive capability needs more upgrades Review collected by and hosted on G2.com.

When securing the enterprise organizations we cannot only depend on SIEM, threat intelligence and firewall management. Protecting internal endpoint devices is one of challenging job for the organization. Carbon Black Response defend against known as well as emerging threats, so the endpoint users work with confidence that their devices are secured. It is user friendly and very effective tool when we consider the endpoint security and Threat hunting. It gives complete visibility of every endpoint/sensors in organization. It provides threat intelligence feeds and reports for all know threats and malware signatures. It also provides customization watchlists by creating own queries so we can set alerts according to requirement. Process and binary searches are very good feature and very useful for threat hunting. We can block/ban the binaries and also isolate the endpoint which is best of the tool. Review collected by and hosted on G2.com.

Analyst requires good skills for investigate and threat hunting purpose, it is somewhat difficult for beginners to work on CB Response as it requires deep knowledge of all the processes and it's executions.

Threat Intel reports generate some false positive alerts which are hectic sometimes. Review collected by and hosted on G2.com.

I can find what I am looking for when I need it. The product providers us with rich telemetry and can pretty much find anything on a machine where many others cannot. Isolate functions very well and it fast. Most SOC/Incident Response providers use this tool so its best to have this in your organization and deployed already. Review collected by and hosted on G2.com.

Some complex searches using wild cards do not work very well. Some searching capabilities could be improved to make it easier. Review collected by and hosted on G2.com.

CB Response provides our staff with an extremely detailed and concise overview of our endpoints. Utilizing the tools provided by Response, we can effectively track threats, be notified of detected threats, and quickly investigate and respond to those threats all from one interface. The fact that this is a single product which incorporates all these tools is wonderful. Review collected by and hosted on G2.com.

As with their CB Protection product, I feel that the administrative interface can be a bit challenging at times. Without prior training on the product, it would be difficult to navigate and perform investigations. Thankfully, the product was provided with an in-depth training process to assist our staff with being acclimated within the environment. By completing the training, my staff was very comfortable navigating and using the product. Review collected by and hosted on G2.com.

We have Carbon Black Response running as part of a Managed Security offering. It has detected quite a few issues on the machines where it was installed. This includes obfuscated powershell code and excel documents that run executables. Having this kind of detection makes use trust our security posture even more.

We occasionally use it for troubleshooting purposes, so nothing security related. Review collected by and hosted on G2.com.

Luckily for us it is a managed service and so we do not have to do anything ourselves. Otherwise is would take a steep learning curve to take the most advantage of this product. Review collected by and hosted on G2.com.

I mostly like the Go Live feature to be able to use that for basic administration and/or for other security reasons and being able to have this way to access a pc is useful for me. Most other features we have not even been able to dive into yet and are currently still reviewing. Review collected by and hosted on G2.com.

I haven't used their support in awhile so I'm not sure on how they are currently doing in that area. Hopefully it's just our server with it being in a master/slave cluster but the email alerts to detection's seem to be slow. Review collected by and hosted on G2.com.

The API's - Ability to write Python or PowerShell Scripts allows us to pull data back faster than if we had to log into the system and it also saves a ton of time. We have also used their Community portal where customers share development scripts.

Intelligence feeds allow us to pull down data from our Threat Intel vendor into CbR and then create WatchList from it.

GoLive - I love this feature to have full access to a machine, it allows us to upload files / scripts and then pull down the results. This has speed up IR. Also gives us a quick way to determine if our AV quarantined a file or if the file still exists on the file system Review collected by and hosted on G2.com.

GoLive command interface could use some work, the commands are very limited and not like the DOS or Linux commands we are used to. Ex Can't do "dir /s" or delete a whole folder.

Creating complex watchlists are not that intuitive, it's easy to mess them up and you would not know it unless you had sample / test cases to run them thru.

Very little access control, either have Global rights or Admin rights. We are two version back, so they have made enhancements to allow access to only certain Sensor groups and GoLive.

Review collected by and hosted on G2.com.

Cb response on Windows endpoints it is easy deploy, maintain and support. Review collected by and hosted on G2.com.

Cb response management tool is not much user friendly especially if you are not well

trained. It may be able to start effective investigation at First side, is better there should be some training for incident response team. Review collected by and hosted on G2.com.

-Ease of use

-Easy to deploy agents

-Ability to auto upgrade sensors as new updates are released.

-Intelligence feeds that make CB response what it is.

-Ability to create custom watch lists Review collected by and hosted on G2.com.

CB tends to push out sensor updates and CB application updates that seem to not have been tested enough which leads to issues in Production that sometimes take longer then usual in resolving. The lack of development with response as there seems to be a lack of updates as CB has been concentrating more on PSC. Review collected by and hosted on G2.com.