Real-time threat response has boosted detection accuracy and reduces manual investigation work
What is our primary use case?
In my field, I have been in the information security area for 17 years, and I am currently working in my position for a year and a half.
I have worked with Trellix Collaboration Security for several years in different outsourcing services before Johnson & Johnson. At BNP Paribas Bank, a French bank, I worked with Trellix Collaboration Security. At Santander Bank, I also worked with Trellix Collaboration Security. Before the banking sector, I worked in a security operations center with Trellix Collaboration Security since the McAfee company.
At Johnson & Johnson, I am not currently using Trellix Collaboration Security. However, before Johnson & Johnson, I worked at Santander Bank where I participated in a project to implement the endpoint in different offices of the bank, coordinating the alignment and sending of policies, tasks, update tasks, and deployment of the new versions of the products.
What is most valuable?
In my experience, the best features related to Trellix Collaboration Security concern the protection against threats. Trellix Collaboration Security has a good solution to protect based on behavior and threat intelligence, reputation, and other features. I appreciated being able to include a malicious hash in the console, and the console then disseminated this information to different databases internally to protect against threats, download of the file for web reputation, and check the malicious activities in the email according to the hashes included in the databases.
Regarding threat intelligence, it helped us with signatures, IOCs, or reports related to geolocation, where we could use it to create correlation in the XDR to block and create a campaign to block different malicious activities based on the historical data published in the threat intelligence and based on reputation. It is very important because it is integrated, so it is not necessary to contact VirusTotal or put the hash in VirusTotal. Instead, I use the database and the threat intelligence from Trellix Collaboration Security. In the past, it helped me a great deal with detecting and confirming whether something was malicious or not.
Another feature I believe is very important is the real-time response capability. It is possible to collect artifacts, run scripts, kill processes, and isolate machines all without leaving the interface. For me, this serves as a bridge between detection and reaction, and it truly makes a difference in the tool.
In my view, Trellix Collaboration Security and other XDRs can help the company elevate the trust in operations. Of course, it is necessary to create automations and integrations with pipelines with CSVs, inventory, normalization of data, and automatically raising incidents for the agents and endpoints. In my view, this reduced manual activities significantly and increased the precision of the indicators. Everything helped the operations team and the engineering team respond more quickly to malicious activities detected. It helped us reduce risks, avoid silent failures, and improve the health in general in the environment. Another important point is that we have an improved security posture because it is possible to treat the findings, adjust policies, and block malicious hashes. With that, we reduced the noise according to the detections, increasing the capacity of prevention and detection. We also improved the resilience of the security tools inside the company.
What needs improvement?
I have had challenges in the past with Trellix Collaboration Security for implementation because of issues related to compatibility. Since we worked in a global company with different operating systems, it was necessary to create different plans and different actions to implement the product.
One thing I really do not prefer in Trellix Collaboration Security is not related to the console. I am a McAfee fan since the McAfee tool, and I find the console of Trellix Collaboration Security to be very user-friendly and easy to use. However, I do not know if it is related to the architecture of the product. Of course, we have modern threats based on behaviors and zero days. We have today CrowdStrike and SentinelOne, where we have better results based on threats and behavior, where it is possible to create a simulation environment based on the file detected and based on it, confirm if it really is malicious or not. In general, I believe Trellix Collaboration Security improved the console based on the last console of McAfee, but I think it is possible to improve more. It really is a good product, but in my view, it needs to improve detection based on behaviors.
Regarding automations, I have implemented Trellix Collaboration Security here at Johnson & Johnson, and I implemented it in the same situation at Santander Bank and BNP Paribas Bank, where I created automations to export data for different metrics, including malicious detections, compliance, baselines, scans, last scans based on the seven days, and checking of patterns. I export everything to CSV files. Based on that, I create Power BI dashboards, and in these Power BI dashboards, I have a more executive view for different metrics to provide to myself, my manager, or director to create an executive view based on it. Another important point we use here at Johnson & Johnson and other companies is a data hub or a SIEM solution, such as Elastic or ArcSight, where we select some logs to be sent and use it to build reports and metrics.
What do I think about the stability of the solution?
Trellix Collaboration Security is stable in my experience, and I agree with this assessment.
What do I think about the scalability of the solution?
Regarding scalability, the strong points of scalability are related to Trellix Collaboration Security's offering and the high availability in a cloud architecture. This creates more possibility to expand without issues. The console is strong and can be used for a large quantity of machines without slowing down. It is possible to improve and create very good scalability. Integration with multiple tools such as email, collaboration platforms, security, and other SaaS solutions is possible through API. This permits the increase of new services without creating a new architecture. It is possible to integrate.
Another aspect is the unified detection and analysis of sandbox, URL, file inspection, and threat intelligence. This creates a more robust increase for a horizontal solution. It creates a good range of use because it really helps a lot. In my view, the limitation about scalability may be related to license and costs. When you include other modules and services, of course, you increase the cost, and because you need to adjust.
How are customer service and support?
Customer support for Trellix Collaboration Security has been very positive in my view. Of course, we have concerns about limitation of support. For example, in evaluations of the
AWS marketplace, some users spoke about the new hub created in India and not having good support. However, in my view, I have not had issues with support. I had a great experience with my recent cases opened. My contract of support at Santander and BNP was a platinum support level, and with that, we really had a good experience.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
Previously at Santander Bank and BNP, we were using McAfee. We continued using Trellix Collaboration Security with some improvements. At Johnson & Johnson, we are in transition from Trend Micro Vision One to CrowdStrike. I have had experiences in the past in security operation centers with different solutions. We had good results when we migrated from McAfee to Trellix Collaboration Security. Trellix Collaboration Security is more modern, and in my view, it organizes the structure of the console better.
How was the initial setup?
Another feature I believe is very important is the real-time response capability because it is possible to collect artifacts, run scripts, kill processes, and isolate machines, all without leaving the interface. For me, this serves as a bridge between detection and reaction, and it truly makes a difference in the tool.
What about the implementation team?
I implemented Trellix Collaboration Security here at Johnson & Johnson, and I implemented it in the same situation at Santander Bank and BNP Paribas Bank, where I created automations to export data for different metrics, including malicious detections, compliance, baselines, scans, last scans based on seven days, and checking of patterns. I export everything to CSV files. Based on that, I create Power BI dashboards, and in these Power BI dashboards, I have a more executive view for different metrics to provide to myself, my manager, or director to create an executive view based on it. Another important point we use here at Johnson & Johnson and other companies is a data hub or a
SIEM solution, such as Elastic or ArcSight, where we select some logs to be sent and use it to build reports and metrics.
What was our ROI?
We did see a return on investment, mostly related to operational efficiency and incident reduction rather than headcount reduction. The biggest ROI came from gaining visibility and reducing manual work. With Trellix Collaboration Security's endpoint telemetry, policy automation, and faster threat correlation, our team spent around 25 to 35% less time on routine investigations. Tasks that previously required manual log collection or waiting for the user became near real-time. That alone freed up analyst time for deeper work instead of repetitive triage.
We also saw a major reduction in noise. After tuning the ENS and aligning the threat intelligence with real detections, we dropped false positives around 20 to 30%, which directly reduced the number of tickets escalated to security operations. The real-time feature is a good capability, and we had good results in the past based on it because it prevents lateral movement and avoids more expensive downstream impacts, such as re-imaging and downtime.
What's my experience with pricing, setup cost, and licensing?
We did not purchase Trellix Collaboration Security based on the
AWS Marketplace.
Which other solutions did I evaluate?
I participated in a recent RFP where we evaluated Microsoft Defender, SentinelOne, CrowdStrike, and Proofpoint to check and create a comparison.
What other advice do I have?
My main advice for others about Trellix Collaboration Security is to go with a clear understanding of what you actually need. Trellix Collaboration Security really is powerful, but it is not a plug-and-play product. The value really shows up when you tune policies, integrate multiple collaboration channels, and leverage the threat intelligence and behavioral analysis model.
Make sure you have the internal capacity for configuration and ongoing tuning. If your environment is complex with multiple SaaS tools, file sharing, and cross-tenant collaboration, it is necessary to create a plan for proper setup. Once configured, the detection depth and cross-layer correction are really strong. In short, it is a powerful platform, but it rewards teams that prepare, tune, and manage it well.
Regarding integrations, Trellix Collaboration Security has good integration with a large list of products, and it is possible to integrate. Performance and integration are good, and support in my experience has provided good results during telephone calls and email requests. For public and private cloud, we had good results, but I prefer to work with the console of Trellix Collaboration Security as a SaaS solution, and it helped in the deployment for cloud, hybrid, or on-premises environments. It depends on the internet link, but in my last experience with Trellix Collaboration Security, I did not have issues related to deployment using the security solution in a cloud environment. We reached a good result during the deployment of new versions and new products without creating a saturation of the link.
Regarding deployment, we used AWS as the main solution here and at Santander Bank. It is the same at BNP Paribas. In the last three experiences I have had, we used AWS.
My review rating for Trellix Collaboration Security is an 8 out of 10.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)