I like CrowdStrike’s strong endpoint detection and the visibility it gives me into endpoint activity. I find the investigation process tree useful, and I like the automated leads that flag suspicious processes or behavior and tell me what to look into. RTR helps me investigate infected and non-infected machines, and I use it for SCCM automation, containment, and data collection. I also value NGSIM’s detailed visibility for the SOC and the telemetry ingestion. I thought the process-wise consumption was good, and the initial setup was pretty quick. Review collected by and hosted on G2.com.

The main drawback for me is the licensing. When I spin up a new instance on a new machine, the license gets attached to that instance, and if I remove the instance, the license doesn’t get removed quickly. Review collected by and hosted on G2.com.