Defender Threat Analytics vs CS Overwatch vs SentinelOne WatchTower

We are currently utilizing Microsoft Defender for EndPoint (and basically all other Defender XDR components). I've had calls with CS, SentinelOne, and a few other vendors that utilize Defender.

One of the things that really interests me is the threat hunting component. Defender has a Threat Analytics feature that provides intelligence, exposure per device, and detections/incidents that match the threat profiles. It's never been particularly useful to me, but I've also never had it "sold" to me before. Is it any different than the threat hunting that is included in OverWatch and WatchTower?

Also a slight tangent, but the core services we utilize for security are ZScaler, M365, and Intune. None of these MDR vendors that provide threat hunting, do any hunting with logs generated by third parties. I'm just a cybersecurity layman, but I would think not including network logs in particular would make it vastly more difficult or impossible to find advanced/persistent threats. Is that an incorrect assumption? Do these threat hunting tools actually provide any value when they're looking through a straw solely at their own endpoint logs? submitted by /u/imscavok
[link] [comments]


http://dlvr.it/T9tZdX