The pricing is garbage. The only benefit is the classic “unreasonable enterprise demands” (UED, that’s my term for it): Rather than use multiple tools that are each best in class (and possibly cheaper or even free!) enterprises will always choose one product that does all the things. Even if it does those things poorly or even worst-in-class.
Example: VMWare. For ages, enterprises used VMWare for all their VMs because it could run/manage both Windows and Linux VMs from a single tool. Even though HyperV for Windows is vastly superior for Windows VMs and KVM is vastly superior for Linux VMs.
Aside: Yes, you can run Linux on HyperV and Windows on KVM but neither are ideal.
Windows Defender as an EDR is OK-ish for Windows but it’ll never top CrowdStrike Falcon or SentinelOne Singularity for Linux. It probably won’t be better than FOSS alternatives like Cilium Tetragon or even Falco (because of their flexibility/customizable nature).
Edit: I also have a pretty firm belief that putting Windows people in charge of managing Linux systems (of any kind) is always a bad idea. Yet the very nature of the product (Microsoft Defender) insists upon this.
Not really, Defender is quite popular as an EDR solution and a lot of companies love the pricing and logging of a modern EDR.
Defender with its timeline is also better than some of the alternatives I’ve seen in the field.
The pricing is garbage. The only benefit is the classic “unreasonable enterprise demands” (UED, that’s my term for it): Rather than use multiple tools that are each best in class (and possibly cheaper or even free!) enterprises will always choose one product that does all the things. Even if it does those things poorly or even worst-in-class.
Example: VMWare. For ages, enterprises used VMWare for all their VMs because it could run/manage both Windows and Linux VMs from a single tool. Even though HyperV for Windows is vastly superior for Windows VMs and KVM is vastly superior for Linux VMs.
Aside: Yes, you can run Linux on HyperV and Windows on KVM but neither are ideal.
Windows Defender as an EDR is OK-ish for Windows but it’ll never top CrowdStrike Falcon or SentinelOne Singularity for Linux. It probably won’t be better than FOSS alternatives like Cilium Tetragon or even Falco (because of their flexibility/customizable nature).
Edit: I also have a pretty firm belief that putting Windows people in charge of managing Linux systems (of any kind) is always a bad idea. Yet the very nature of the product (Microsoft Defender) insists upon this.