EDR

[Fred Claus]

When it comes to EDR for a microbusiness who do you like? I'm researching Malwarebytes, OpenEDR, and Huntress. Currently I have Malwarebytes on a couple machines, I've just signed up for a free OpenEDR account. Not sure about Huntress though.

Thoughts on any of these?

 

[GTP]

Never heard of EDR or Huntress. Malwarebytes is OK as long as you can put up with the constant barrage of spam from their sales people.

 

[callthatgirl]

I quite using MBAM in 2017 or so, after it was crashing my office to the death. I still remove it from clients' computers as it's just about as bad as Norton imo.

 

[Mike McCall]

Bitdefender has an EDR that I use. I had not heard of OpenEDR before you mentioned it. Apparently, it's a Comodo product they made open source in 2020.

https://www.zdnet.com/article/comodo-open-sources-its-edr-solution/

 

[YeOldeStonecat]

Never heard of EDR or ...

"EDR" is/was the next evolution of "antivirus". EDR = Endpoint Detection and Response. It works quite differently than traditional antivirus as we know it. You can actually pair it with traditional (legacy) antivirus software...although most don't.

Where traditional antivirus engines work via definitions, and scanning files, and they can do a bit of heuristic and behavior blocking,
EDRs work differently, EDRs monitor the behavior of all applications, to detect suspicious or anomalous activity, and they automate containment, remediation, investigation, and rollback. They are meant to create full reports of the incident, and tie into SIEM solutions.

EDRs do require more configuration and setup, and more ongoing maintenance and tuning.

One of the early bigger names of EDRs is Sentinal One. We provide that for our clients that have cyberinsurance that dictates EDRs.

While we do Bitdefender with our RMM for most clients, we don't use their EDR....and I'm shifting away from Bitdefender...moving towards Microsofts "Defender for Endpoint" managed by 365BizPrem. Which is substantially more powerful than the plain stand alone Defender AV built into Windows...the 365 tenant unlocks many features. The regular Defender P1 in Biz Prem doesn't unlock all the features to make it a full EDR, however Defender P2 does....for clients that need it.

There are dozens of EDRs out there, many of the traditional "big brands" of AV make them, such as BD, Eset, Symantec, TrendMicro, and others. Some big EDR brands I see in various tech forums...Huntress is big, Cylance, Crowdstrike also...and the SentinalOne I mentioned above.

The Malwarebytes that the OP mentions here is not the vanilla MWB most here think of...MalwareBytes makes a full EDR product that is totally different that the "cleaner".

But wait....didn't know what EDR is? We've already evolved beyond that too!
XDR and MDR!
Well, MDR Isn't too different from EDR..it's just Managed Detection and Response. Meaning, a service that more automates and takes care of things going on. You purchase this as a service, offload the work from your.
However, XDR is an evolution of EDR..."Extended Detection and Response"...on the large scale. It ties together endpoints, as well as other avenues into systems....firewalls, email, web filtering, network analyses, even identity and access. It really looks at "the whole picture"...ties it all together, and makes its moves globally on the entire infrastructure from top to bottom. Microsofts Defender plans are evolving into this...as it manages more than just endpoints, it also ties in url filtering, email attachments, cloud file storage, endpoints,

 

[Fred Claus]

Thanks for the information, I didn't know all the people who did EDR. OpenEDR is Xcitium which is Comodos new name. Their base service is free. The drawback is that the website to get into the dashboard isn't stable. It's crashes at least twice a month.

I looked into Defender for Endpoint as well. The person at Microsoft isn't getting back to me though. Do you know what the per endpoint cost is? Is there a minimum to start?

 

[YeOldeStonecat]

Microsoft Defender for Endpoint - Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is an enterprise endpoint security platform that helps defend against advanced persistent threats.

learn.microsoft.com

I don't go lower than Microsoft 365 Business Premium which includes Defender P1....
Stand alone Defender P1 MSRPs about $2.40 per user per month, 0.80 for non profits
Defender P2 MSRPs about $6.00 per user per month, $2.00 for non profits

Included in some of the higher E plans

 

[Fred Claus]

I'll have to look into this. I have a nonprofit client who has 10 free Office365 licenses. I wonder if P1 is included. I know it's business either premium or pro.

 

[YeOldeStonecat]

Microsoft donates Microsoft 365 Business Premium 1-10 licenses FREE...for non profits, that does include Defender P1, also InTune, Azure P1, etc.
That's the license you want for non profits. Licenses 11 and onwards are just $5.00 per user per month.
M365 is different than legacy O365.

 

[Fred Claus]

Thanks. I'll have them check it out.

 

[Fred Claus]

Let me run this by you all. I have residential clients as well as micro-business clients. Do you think that Windows Defender with a Malware license added on is just as good of protection as something like Bitdefender alone? Would there be anything special as far as the protection goes that would be worth getting Bitdefender? I look at AV-Test.org and see that Malwarebytes, Windows Defender, and Bitdefender all have roughly the same rating. What are your thoughts? The only thing I can see as an advantage would be the extra features like a content filter.

 

[YeOldeStonecat]

I'd be fine with Microsofts Defender antivirus for residential users.
While I don't think it's "as good as Bitdefender"....it's darned near nearly as good.
The antivirus comparison site I always liked is avcomparatives.org
This past Mays real world comparison, Bitdefender got 100%, Microsoft Defender 99.8%
...so... 0.02% diffy. Meh.

If I were to set up a computer for a family member right now, I'd just leave Defender on it.

 

[Fred Claus]

I'd be fine with Microsofts Defender antivirus for residential users.
While I don't think it's "as good as Bitdefender"....it's darned near nearly as good.
The antivirus comparison site I always liked is avcomparatives.org
This past Mays real world comparison, Bitdefender got 100%, Microsoft Defender 99.8%
...so... 0.02% diffy. Meh.

If I were to set up a computer for a family member right now, I'd just leave Defender on it.

That's what I was thinking too. Then you run into all these YouTube videos where they say that Windows Defender is terrible and you really need to buy this one instead. I wonder how many of those videos are actually affiliate links to the antivirus that they're promoting. If you look at their tests and what they say and compare it to something like AV comparison, nine times out of 10 the results are completely different.

 

[SAFCasper]

FYI the licence included in M365 Business premium is actually "Microsoft Defender for Business" which sits between Defender P1 and P2 in terms of features.

Defender for Business is also available as a standalone package, priced the same as P1, so there really is no reason ever to purchase Defender P1 unless you have more than 300 users.





Source: https://learn.microsoft.com/en-us/m...ss/compare-mdb-m365-plans?view=o365-worldwide

 

[britechguy]

This past Mays real world comparison, Bitdefender got 100%, Microsoft Defender 99.8%
...so... 0.02% diffy. Meh.

And if you check the ratings over the last several years, and cycles per year, the top 10 tend to stay there, and flip-flop in position all the time.

As you have pretty clearly pointed out, if you look at the numbers, they're generally statistically insignificant. And all it takes is one definition not yet having "hit" one product, versus another, at the moment the tests are running to make that kind of difference. Less than a day later, all things might be equal, or flip-flopped.

 

[YeOldeStonecat]

Yup...agreed...I like to look at the average over time. For many...many years I've kept my eyes on avcomparatives...and mostly the "real word tests". (which...read on how they do those, compared to most "in the lab tests"). My favorite antivirus review...by far...actually..the ONLY one I refer to!

 

[britechguy]

@YeOldeStonecat

My "little lecture" on antivirus and evaluating same, that I've been using for years. Your favorite is in my top 4 (in no particular order of preference):

Look at the most recent testing results from the following antivirus/security testing labs, along with the historical results from the past several years if you want to see how Windows Security/Defender has been performing. Windows Security has been solidly in the top 10, often top 5, and frequently beats out several well-known competitors that one must pay for.

AV Test (See Windows test section)

AV Comparatives (Reports Page – Look at Real-World Threat Protection and Advanced Threat Protection Test reports)

SE Labs (Reports Page – Look at Endpoint Security Reports)

MRG Effitas (360° Assessment & Certification Reports)

The differences in the results between these organizations is interesting to see, too. And that variability at the same time for the same sorts of tests tells me that the exact "how" of a given test determines the outcome as much as the product being tested does. There is no perfect antivirus and there is no perfect antivirus evaluation test.

 

[YeOldeStonecat]

And AV Comparatives separates the "consumer versions" from the "business/enterprise versions"...which a few other testing websites do not.
Which..of course, I like to see.

Business Security Test 2023 (March - June)

The first half-year report of our Enterprise main-test series containing a Real-World Protection, Malware Protection and Performance Test has been released. Also product reviews are included. Read the report for details.

www.av-comparatives.org

Microsofts does pretty well in these tests. It did kick in 2x false positives, and did have a little more system impact on performance, than others..hence its lower final store (middle of the pack..or a hair below). BUT...overall detection was excellent!

I'd have to say, consistently over a nearly 20 year run, that the top 3 are usually Bitdefender, Eset, and Kaspersky. However with Microsoft such a....really negligible click right behind them nipping at their heels....I'm happy with it.

 

[Sky-Knight]

EDR = Defender for Business (Defender for Endpoint that comes with Business Premium)
MDR = Tenant enrolled in our Sentinel instance, managing the above.
XDR = Tenant enrolled in their own Sentinel instance, managing the above.

3rd parties? Don't need them... Microsoft all the things.

SOME of the XDR clients also have DLP needs, those people get Defender for Endpoint P2. That's when we get some really crazy things happening... like users cannot use USB drives anymore... PDF files have special rules, etc.