G2

Verified User in Computer & Network Security

Mid-Market (51-1000 emp.)

9/24/2026

"Stronger Network Visibility and Faster Threat Investigation with Trellix NDR"

4/5

What do you like best about Trellix Network Detection and Response (NDR)?

What I like most about Trellix NDR is the network visibility it provides for security monitoring and incident investigations. We use it to investigate suspicious network communications, identify unusual traffic patterns, and get additional context when investigating security alerts.

It is particularly useful when endpoint telemetry alone does not provide enough information. Being able to review network connections and related activity helps us understand what a system was communicating with and supports our incident response investigations.

The platform also works well as an additional layer alongside our existing security tools and helps provide broader visibility across the environment. Performance has been generally good for continuous network monitoring, although there is room for improvement in alert prioritization and investigation workflows. Review collected by and hosted on G2.com.

What do you dislike about Trellix Network Detection and Response (NDR)?

The main area I would like to see improved is the investigation experience. When there are a large number of alerts or network events, it can take additional effort to identify the activity that requires immediate attention.

The UI could be more intuitive, particularly when pivoting between network connections, alerts, and related events. Better correlation and automation would also reduce the amount of manual investigation required from analysts.

Integration with other security platforms is important in our environment, and having more out-of-the-box integrations and automated workflows would make the product more useful. Additional AI-driven alert summarization and prioritization could also help analysts quickly understand the context and focus on higher-value investigations. Review collected by and hosted on G2.com.

What problems is Trellix Network Detection and Response (NDR) solving and how is that benefiting you?

Trellix NDR helps us address the gap in network-level visibility that can exist when relying primarily on endpoint security tools. We use it to monitor network activity, investigate suspicious connections, and identify unusual communication patterns that require further investigation.

During security investigations, the network telemetry provides additional context around an endpoint or user, such as external communications and network activity. This helps our security team correlate network data with endpoint and other security telemetry and build a better understanding of an incident. It is also useful for threat hunting and validating suspicious activity identified through other security controls.

From a performance perspective, the platform provides useful visibility for continuous monitoring and handles our monitoring requirements well. The main ROI comes from having network-level telemetry available in the same investigation workflow, which can reduce the time analysts spend manually correlating data from different sources.

From a pricing perspective, the value depends heavily on the size of the environment and how much the organization relies on the network detection capabilities. For organizations already investing in multiple security controls, the ability to consolidate network visibility and improve investigation efficiency can contribute to the overall ROI.

The onboarding experience is generally straightforward, but having clear deployment guidance, integration documentation, and responsive technical support is important when deploying NDR at scale. Stronger out-of-the-box integrations and more automation during onboarding would further reduce the operational effort required from the security team. Review collected by and hosted on G2.com.