This message was deleted.
# citrix-vads
Slackbot
11/01/2019, 12:20 PMThis message was deleted.
w
Webster Webster
11/01/2019, 1:03 PM@Oz Zy
s
Steve Elgan
11/01/2019, 1:21 PMWe are running in our XenApp environment. It's great!
Steve Elgan
11/01/2019, 1:22 PMWith the later versions, no gotchas. On the 4x and early 5x versions, non-persistent didn't work really well. Now it does.
Steve Elgan
11/01/2019, 1:22 PMIMO, everyone who hates AV penalties in VDI/SBC should switch to traps. Hardly noticed the impact of the agent and superior protection.
Steve Elgan
11/01/2019, 1:23 PMRead the palo edocs carefully. They had so many ways to prep a non-persistent machine. With new versions is quite simple.
b
Barry Browne
11/01/2019, 1:59 PMThat is exactly why we are interested in Traps, low footprint, and it still gets the job done.
Barry Browne
11/01/2019, 2:09 PM@Steve Elgan before traps, what AV solution were you using?
s
Steve Elgan
11/01/2019, 2:51 PMTrend Micro Deep Security.
Steve Elgan
11/01/2019, 2:52 PMon VMWare with NSX Guest Introspection
Steve Elgan
11/01/2019, 2:52 PMquite complicated comparatively. Lots of dependencies to get scanning working.
Steve Elgan
11/01/2019, 2:53 PMI guess I will say on the VDI stuff with Traps that there is 1 gotcha. You can install the agent and then run an image prep process where it pre-scans all your EXEs and then you can pre-stage the verdicts. This way EXEs on your master image are in effect "whitelisted".
Steve Elgan
11/01/2019, 2:53 PMIf you make changes to the image you may want to run that process again. It can take an hour or longer to complete
Steve Elgan
11/01/2019, 2:55 PMRead the Configure a Traps Agent in a Non-Persistent VDI section
Steve Elgan
11/01/2019, 2:58 PMlow footprint benefits aside, just the concept of how they handle malware by trapping for 24 known exploit techniques is way smarter than managing billions of file definitions. This is disruptive endpoint protection IMO.
Steve Elgan
11/01/2019, 3:00 PM@Eltjo van Gulik @Ryan Ververs-Bijkerk It would be cool to see a GO-EUC study on the impact of user density with Traps vs "the leading vendor"
o
Oz Zy
11/01/2019, 3:38 PMI think Steve said it all. Yea, we have been partnering with Palo for quite some time and their Traps product is second to none IMO for all of the reasons Steve mentioned. You can run it with or without Palo Alto Firewalls, however having the whole stack provides added benefits of course.
j
Jon Bucud
11/01/2019, 9:57 PM@Morgan Jones Good info from Steve/Oz re: Traps vs TrendDS
m
Morgan Jones
11/01/2019, 10:05 PMCan you guys comment on the relative cost of traps vs TrenDS without the PA firewall?
s
Steve Elgan
11/01/2019, 10:26 PMWe were subscribing to TMDS for the virtualization environment and trend micro office scan for the windows and points. We have since moved to traps for all Windows devices. My overall costs went up quite a bit. However looking strictly at the virtualization environment I think the costs are cut in half
Steve Elgan
11/01/2019, 10:26 PMEndpoints
Steve Elgan
11/01/2019, 10:27 PMA lot of it depends on how many devices you need to protect and the quantity you are buying. We license 700 and points which includes server virtualization
m
Morgan Jones
11/01/2019, 10:29 PMAnd you were using DS with guest introspection, and TRAPS ended up cheaper... hmm. We may have to take a closer look at it. We are getting ready to do a Trial and POC of DS, since we already run officescan in our environment. Seemed easiest to go to DS / Apex . Do you feel TRAPs does a better job for AV/AM than the DS Solution?
j
Jon Bucud
11/01/2019, 10:31 PM^ OfficeScan's seal process is a pain point as well (TCacheGen being 100% manual)
s
Steve Elgan
11/01/2019, 10:40 PMPart of the reason why it was cheaper is that we bought so many and points in total. Had I just protected my virtualization environment it may have been similar in cost. You know, some of this also boils down to how well you negotiate. We are a nonprofit organization so we can get better discounts sometimes.
Steve Elgan
11/01/2019, 10:41 PMTraps is by far the most superior endpoint protection on the planet period. IMO that is.
Steve Elgan
11/01/2019, 10:42 PMOnce you learn how it works you will be kicking your self for using a traditional antivirus. It is a game changer
Steve Elgan
11/01/2019, 10:43 PMTMDS is very complicated to deploy comparatively. You can return so much capacity back to you or your team by the deploying a simpler solution. We had so many problems getting the introspection servers to remain online all the time.
m
Morgan Jones
11/01/2019, 10:43 PMThose are pretty strong words. Thanks for the share, we'll definitely take a look. I'm assuming they have good server os protection as well as desktop?
s
Steve Elgan
11/01/2019, 10:43 PMSame agent. Different command line options depending on your scenario like terminal server or VDI
Steve Elgan
11/01/2019, 10:45 PMNot sure if you have a good reseller or not but if not talk to @Oz Zy. They work with a incredibly smart Palo Alto integrator called Norlem. They put on boot camps where you can get hands-on with the product and that is where you really see the power of the product
j
Jon Bucud
11/01/2019, 10:46 PMThanks Steve
s
Steve Elgan
11/01/2019, 10:47 PMThey let you install ransomware on machines and you can see how traps stops it at various different attack chains because usually it takes 3 to 6 successful exploits to take ownership of a machine.
5 Views