Back Ground Image

Compare Xcitium To TrendMicro

EDR- labs statistics
Features Breakdown Xcitium EDR Logo Horizontal Dark EDR Trend-Micro-Logo
EPP Capabilities
Signature-based anti-malware protection
Machine learning/Algorithmic file analysis on the endpoint
Machine learning for process activity analysis
Process isolation
Memory protection and exploit prevention
Protection Against Undetected Malware
Application whitelisting
Local endpoint sandboxing/endpoint emulation
Script, PE, or fileless malware protection
Integration with on-premises network/cloud sandbox
Real-time IoC search capabilities
Retention period for full access to data No Limit 32 days
Endpoint Firewall
FW Learning Mode
Automatically creates network traffic rules
URL Filtering
Host Based IPS
USB device Contol
Full Device Control (Device Control based on Device Class product ID, Vendor ID and Device Name)
Agent self-protection/remediation or alerting when there is an attempt to disable, bypass, or uninstall it
Ransomware protection
Protect/block ransomware when "Offline" or "Disconnected" from the internet?
VDI support
Manage, and maintain, an application control database of known "trusted" applications?
Multi-tenant cloud based service
EPP management console available as an on-premises virtual or physical server/application
Consolidated EPP management console to report on, manage, and alert for Windows macOS clients and mobile
Data loss prevention Requires Additional Product(s)
Mobile Device Management Requires Additional Product(s)
Mobile Threat Defense Requires Additional Product(s)
Vulnerability and patch management Requires Additional Product(s)
Network/Cloud sandboxing Cloud Sandbox Cloud Sandbox
Security Orchestration, Analysis and Response (SOAR) Integration
Network discovery tool Requires Additional Product(s)
Remote Access Requires Additional Product(s)
Remote scripting capabilities Requires Additional Product(s)
Default Deny & Containment
Default Deny Security with Default Allow Usability
Run unknown files with Zero Threat 100% Protection
Create Virtual environment for any unknowns
Virtualize file system, registry, COM on real endpoints
Telemetry (EDR Observables)
Interprocess Memory Access
Windows/WinEvent Hook
Device Driver Installations
File Access/Modification/Deletion
Registry Access/Modification/Deletion
Network Connection
URL Monitoring
DNS Monitoring
Process Creation
Thread Creation
Inter-Process Communication (Named Pipes, etc)
Telemetry data itself can be extended in real time
Event chaining and enrichment on the endpoints
Detection/Hunting/Reporting
Adaptive Event Modelling
Behavioral analysis (e.g. Analysis over active memory, OS activity, user behavior, process/application behavior, etc.)
Static analysis of files using capabilities such as machine learning (not including signature based malware detection)
Time-series analysis
Integration with automated malware analysis solutions (sandboxing)
Threat Hunting interface or API for searching with YARA/REGEX/ElasticSearch/IOC without Yara IOC/ Regex /Yara
Support for matching against private IOC
Threat Intelligence integration (TIP, upload, webservice connector, etc) to enrich and contextualize alerts
Linking telemetry (observable data) to recreate a sequence of events to aid investigation
Process/attack visualization
Incident Response Platform (IRP) or orchestration integration?
Vulnerability reporting (ex. reporting on unpatched CVEs)
Alert prioritization based on confidence, able to define thresholds for alerting.
Alert prioritization factors system criticality
Able to monitor risk exposure across environment organized by logical asset groups
Reporting interface identifies frequent alerts that may be appropriate for automating response
Response
Remote scripting capabilities
Quarantine and removal of files
Kill processes remotely
File retrieval
Network isolation
Filesystem snapshotting
Memory snapshotting
Managed Endpoints (MDR)
Manage customer endpoints and policies
Incident Investigation & Response
Preemptive containment
Application profiling (AI support)
Customizable policy creation
Central monitoring of all endpoints
Live remote inspection Requires Additional Product(s)
Tuning of monitoring rules for reduction of false positives Requires Additional Product(s)
Forensic analysis Requires Additional Product(s)
Managed Network
Cloud-based SIEM and Big DataAnalytics Requires Additional Product(s)
Log data collection/correlation Requires Additional Product(s)
Threat intelligence integration Requires Additional Product(s)
Network profiling (AI support) Requires Additional Product(s)
Available as virtual or physical Requires Additional Product(s)
Integrated file analysis (cloud sandbox) Requires Additional Product(s)
Full packet capture Requires Additional Product(s)
Protocol analyzers for 40+ different protocols such as TCP, UDP, DNS, DHCP, HTTP, HTTPS, NTLM, etc. with full decoding capability Requires Additional Product(s)
Managed Cloud
Includes ready-to-use cloud application connectors for:    
Azure
Google Cloud Platform
Office 365
AWS
Threat detection for cloud applications
Log collection from cloud environments
Generating actionable incident response from cloud application
Threat intelligence and Verdict
Holistic security approach Combined network, endpoint, cloud Requires Additional Product(s)
Internal security sensor logs (IOCs) Requires Additional Product(s)
Expert Human Analysis Requires Additional Product(s)
ML & Behavioral Analysis and Verdict Requires Additional Product(s)
Open source threat intelligence feeds Requires Additional Product(s)
Information sharing with industry Requires Additional Product(s)
Clean web (phishing sites, keyloggers, spam) Requires Additional Product(s)
Deep web (C&C servers, TOR browsers, database platform archives—pastebins) Requires Additional Product(s)
Cyber Adversary Characterization Requires Additional Product(s)
Security Operations Center (SOC)
Global, real-time support (24 / 7 /365)
Dedicated cybersecurity expert
Breach (case) management
Security monitoring
Incident analysis
Incident response (handling)
Extensive threat hunting (scenario-based)
Awards/Certifications
CRN-EDRAVlab- EDRAVtest Approved Endpoint Detection and ResponseAVtest Approved EDRtop infosec innovator logo
View Our Report