Compare ATP vs SEP

Question

Has anyone found a solid feature comparison of ATP against SEP? We're using SEP right now, and I've been tasked with creating an apples to apples comparison/contrast of the two platforms. If anyone can help point me in the right direction, it would be appreciated greatly.

Just FYI, I have been to the actual ATP page and, while there is a tremendous amount of information there, I'd like to see if there's an existing compare/contrast document before I'm forced to make my own.

Cheers

clsec · Answer

David Caddick&nbsp;;What do you mean by Swap?? If you are referring to migrating SEP to WDATP, I can share some experience. I just migrated a client&nbsp;workstations from McAfee Endpoint Protection to WDATP. They were more than happy with the result seen thus far.&nbsp;&nbsp;

david caddick · Answer

Hi&nbsp;clsec,&nbsp;That's what we are doing now, setting ASR rules to Audit only to start with and making sure that we understand what needs to be added so that we don't inadvertanly break things as we enforce the rules.&nbsp;Some tips for others that might help?Reviewing the Audit log details from the Event Viewer looks like a big time suck, it's easier to do this from the Advanced Hunting console in either the Defender or the Threat Protection console using something like this:&nbsp;&nbsp;DeviceEvents//Define which machine you are targetting - |where DeviceName startswith "name_of_device"|where ActionType startswith "Asr" or ActionType startswith "Exp"The neat part of this is that you can now download this in a much easier to read spreadsheet/csv formatThe other aspect I am investigating is how to run an assurance test to validate/check on the actual device that you are getting the correct settings that are required (this is tedious) so there are some tools that can help:HardeningAuditor tool - looks brilliant, although has focused on the Australian ASD guides for 1709, so needs some updating -&nbsp;https://github.com/cottinghamd/HardeningAuditorMicrosofts Security Compliance Tool -&nbsp;https://www.microsoft.com/en-us/download/details.aspx?id=55319&nbsp;Next step is to see if it's possible to upload/import the resulting security into Intune as a new baseline perhaps, we'll see as we dig into this area&nbsp;Regards,Socially distancing Dave 😉

david caddick · Answer

Hi&nbsp;bbrehart&nbsp;I have not seen anything like that, but would be keen to know if someone has one...&nbsp;I'm also looking for details from anyone that has swapped and the process of how to do that swap at scale...

jim sabel · Answer

clsec&nbsp;&nbsp;I'd be interested in hearing about your experience.

david caddick · Answer

clsec&nbsp;So I guess one question is how did you approach the ASR and Exploit guard settings, etc as some of these can be set in Audit only mode to start with to gather intel before enbling in enforced mode?If set in Audit only mode then you don't neccessarily have the protection enabled - so did you run them side by side - or just rip and replace? These are the sort of details we were wondering about.&nbsp;Any sort of additional info would be helpful - thanks

Forum Discussion

Compare ATP vs SEP

Share

Resources