Red Canary Pricing Overview

Having a team of qualified security professionals watching your systems 24x7 is a great assurance. Review collected by and hosted on G2.com.

It took some asking, but seems the SLA is two hours for evaluating an event that may be an incident. In practice, we have done much better, with some responses in under 3 minutes. Review collected by and hosted on G2.com.

Red Canary excels at ingesting and correlating telemetry and alerts from our Microsoft Defender suite, combining and deconflicting that data into a single, cohesive threat narrative for a given machine or activity. This correlation capability provides a clearer picture of threats than we get from our other tools and can reduce the time our analysts spend on manual investigation. The platform itself is intuitive and well-designed, making it easy to navigate and use. Additionally, the customer support has been excellent—particularly Annalise and Matthew, who have been responsive and helpful, with Matthew providing deep technical assistance on integrations and automation. Overall, Red Canary adds meaningful value to our security operations. Review collected by and hosted on G2.com.

While Red Canary offers strong automation capabilities, there are some limitations that impact our ability to fully leverage the platform. One of the main issues is the inconsistency between the GUI, automation platform, and API. For example, when closing out threats, the options available in the automation platform differ from those in the GUI and API—such as missing specific closure reasons like "Internal testing." Additionally, the automation platform only supports "AND" logic in trigger conditions, which makes it difficult to build flexible workflows that share common traits but differ in just one condition. These limitations force us to rely on custom scripts and direct API calls to achieve the functionality we need, rather than managing everything within Red Canary itself. Review collected by and hosted on G2.com.