Trellix Network Detection and Response (NDR) Reviews & Product Details

What I value most about Trellix Network Detection and Response (NDR) is its focus on network visibility and threat detection, which are essential for identifying suspicious activity and supporting effective cybersecurity operations. The ability to investigate potential threats, understand network activity, and support timely incident response is particularly important for organizations facing increasingly sophisticated cyber risks. A solution that brings these capabilities together can help security teams make informed decisions and strengthen their overall security posture. I would place particular emphasis on its detection accuracy, ease of use, integration with existing security tools, and effectiveness in real-world situations when evaluating its overall value and deciding whether to recommend it. Review collected by and hosted on G2.com.

One area I would pay attention to is the overall ease of deployment, configuration, and ongoing management. As with network security solutions generally, integration with existing infrastructure and the time required to investigate alerts can affect the user experience. Clear documentation, an intuitive interface, and straightforward workflows are important for helping security teams work efficiently. I would need more hands-on experience to identify any specific shortcomings in Trellix NDR and assess how well these areas are addressed. Review collected by and hosted on G2.com.

What I like most about Trellix NDR is the network visibility it provides for security monitoring and incident investigations. We use it to investigate suspicious network communications, identify unusual traffic patterns, and get additional context when investigating security alerts.

It is particularly useful when endpoint telemetry alone does not provide enough information. Being able to review network connections and related activity helps us understand what a system was communicating with and supports our incident response investigations.

The platform also works well as an additional layer alongside our existing security tools and helps provide broader visibility across the environment. Performance has been generally good for continuous network monitoring, although there is room for improvement in alert prioritization and investigation workflows. Review collected by and hosted on G2.com.

The main area I would like to see improved is the investigation experience. When there are a large number of alerts or network events, it can take additional effort to identify the activity that requires immediate attention.

The UI could be more intuitive, particularly when pivoting between network connections, alerts, and related events. Better correlation and automation would also reduce the amount of manual investigation required from analysts.

Integration with other security platforms is important in our environment, and having more out-of-the-box integrations and automated workflows would make the product more useful. Additional AI-driven alert summarization and prioritization could also help analysts quickly understand the context and focus on higher-value investigations. Review collected by and hosted on G2.com.

I really appreciate Trellix Network Detection and Response's accurate threat detection with low false positives, which is crucial for my work. The fast incident investigation and forensics capabilities are also fantastic, providing deep insight when necessary. Additionally, its real-time threat detection and deep packet forensics work very well for me, allowing me to stay ahead of potential security threats. Switching to Trellix from Cisco Stealthwatch was a good move as it offers better threat intelligence and stronger integration with my existing Trellix Endpoint Security. Review collected by and hosted on G2.com.

The UI can be slow when handling large data, and the initial setup is complex. It could be more user-friendly and easier to deploy. Review collected by and hosted on G2.com.

I really like Trellix Network Detection and Response (NDR) for its real-time network visibility and the ability to quickly detect suspicious activities. It makes threat investigation easier by providing useful context and helps security teams respond to incidents more efficiently. The real-time visibility also helps me quickly identify unusual or potentially malicious activity, which reduces investigation time and provides better context during security incidents, allowing the team to respond to threats before they can have a larger impact. Review collected by and hosted on G2.com.

Overall, Trellix NDR works well, but the user experience could be improved. I would like to see a simpler interface, more customizable dashboards and reports, and easier integration with other security tools. Faster investigation workflows and more clear, actionable alerts would also make it more efficient for daily use. I would suggest making the interface more intuitive and customizable. It would be helpful to have flexible dashboard layouts, customizable alerts and notifications, better filtering and search options, and the ability to save user-specific views. Improving navigation and providing clearer visual indicators for important events would also make the platform easier and faster to use. Review collected by and hosted on G2.com.

I like the capability of Trellix Network Detection and Response (NDR) to provide good network visibility and quickly identify bad behaviors or potential threats. It allows me to have a clearer view of what's happening in the network environment, enabling the detection of communication patterns and abnormal behaviors, as well as verifying threats more quickly. This helps in having a quick and informed response. Review collected by and hosted on G2.com.

The interface could be simpler and more intuitive, especially to facilitate quick alert analysis and investigation. Improving alert prioritization and contextualization would reduce false positives and highlight more critical incidents more clearly. Additionally, better integration with other security tools and existing systems, along with more customized reports and dashboards, could facilitate the daily work of the team and improve decision-making. Review collected by and hosted on G2.com.

I enjoy Trellix Network Detection and Response (NDR) for its real-time network visibility, precise threat detection, behavior analysis, and alerts. These features help our SOC team investigate cases more efficiently. The integration with other security systems enhances our operations. I appreciate the quick detection of suspicious network behavior through real-time visibility and the ability of behavioral analytics to detect threats that signature-based analytics might miss. The prioritized alerting ensures we can respond efficiently to any situation. Review collected by and hosted on G2.com.

I find the initial setup and policy configuration laborious, and I believe that further customizations to the dashboard, reports, and integrations would add value. Some alarms also require further tuning to reduce the number of false alarms. Review collected by and hosted on G2.com.

I like the visibility Trellix Network Detection and Response (NDR) provides into network activity. It allows me to understand the bigger picture during a security incident. The network activity and connection details are especially useful because they give me quick context. Review collected by and hosted on G2.com.

I think the main area I would improve is the alerting experience. Some alerts can require extra investigation to understand their importance. So clearer prioritization and more concise context would make the response process faster. Review collected by and hosted on G2.com.

It is very fast and reliable, with the fastest detection and investigation, I love its SOC. Some of the information I don't know about it so I'd love to learn about it. Review collected by and hosted on G2.com.

Deployment and initial tuning takes effort and the UI could be more intuitive. Support response times could also be improved, and the cost is a bit high compared to alternatives, but once tuned it performs well. Review collected by and hosted on G2.com.

The interface is intuitive, with easy navigation and clear visualizations of network threats and security events. It also supports integration with various security tools, which helps centralize threat detection and incident response. Network monitoring feels reliable, and it can quickly detect suspicious activity. Overall, it helps reduce manual investigation effort and improves the security team’s efficiency, contributing to better ROI. I also appreciate the intelligent threat detection, which helps identify anomalous behavior and potential security threats more effectively. Review collected by and hosted on G2.com.

UI / UX: Parts of the interface can feel a bit complex, and some workflows would benefit from being more streamlined.

Integrations: Setting up integrations with certain third-party tools may require extra configuration and hands-on effort.

Performance: When working with large volumes of network data, analysis and investigation can sometimes feel slower than expected.

Pricing / ROI: Pricing may be on the higher side for smaller teams or organizations with tighter security budgets.

Support / Onboarding: The initial setup and onboarding process can come with a learning curve, particularly for new users.

AI / Intelligence: AI-driven insights could offer more context and clearer explanations for why specific detections and recommendations are being surfaced. Review collected by and hosted on G2.com.

What I like most about Trellix NDR is the visibility it gives into network activity. It makes it easier to spot unusual traffic, suspicious connections, and behavior that may otherwise be difficult to notice through traditional monitoring alone.

I also find the investigation side useful. When an alert comes in, having the related network activity available in one place helps us understand what happened and whether it is actually something that needs attention. It is especially helpful as an additional layer of detection alongside other security tools. Review collected by and hosted on G2.com.

One thing I dislike is that the platform can feel a bit complex at first, especially when you are trying to understand why a particular alert was triggered. Some alerts need additional investigation and tuning before they become really useful, otherwise there can be unnecessary noise. Review collected by and hosted on G2.com.