What do you like best about the product?

Catalina is a small to medium size company which some MSSP may put less priority when it comes to coverage however throughout the many years with Red Canary and working with their team, never once have I felt as if we weren't a priority client to them.

From their customer support, incident response, threat investigation and continous hands-on helping deploy and technology and secure our environment, Red Canary always provide timely and extremely effective services!

Also the Threat Investigation integration abilities to add all of our security sources to a single centralized review area has definitly made my and our analysts life easier! (with continous new source options rolling out)

What do you dislike about the product?

I wouldn't go so far as say "dislike", but rather a weakness that has seen continous improvement throught the years is the Red Canary portal. As they need to have it operational for all their customers and not specific for everyone, there can be some limitations or hard time placing feature requests if not enough clients also make the ask. Filtering can be very case sensitive, tagging had some improvements done and myself had some redirect issues something when accessing the home page itself.

But overall comparing starting day to where it is now, it's definitly in a much more comfortable position with great reports readily available, more easily navigable and quick automation rules that can be placed.

What problems is the product solving and how is that benefiting you?

Red Canary monitores and provides access to our EDR agents and other Security sources under a unified protal which we have been using as evidence for SOC2 controls as well as all incidents triaging. The Threat Investigation concern gives us almost a "mini-SIEM" option that, while transitioning from actual SIEM solutions, we knew we still had a data point collecting our firewall, EDR, Azure and other alert sources (while it's not at the logs level of a SIEM, we never felt as if we had a full blind spot).