Hi everyone! 👋 I've been running Trend Micro Vision One in our environment for about 18 months now, primarily for its XDR capabilities and the Workbench for incident response. It's been solid, but with recent budget reviews, we're being asked to evaluate the landscape. The immediate internal suggestions are always CrowdStrike and SentinelOne, but I'm specifically looking to explore the space *beyond* those two giants.
I'm curious what the community is using, especially in DevOps-heavy environments. Our stack is Kubernetes on EKS, with a heavy CI/CD pipeline (GitLab), and we care deeply about observability integration (think OpenTelemetry, Prometheus). Vision One's API has been decent for pulling alerts into our dashboard, but I'm wondering if there are tools that feel more "native" to a cloud-native, GitOps workflow.
My ideal alternative would have:
* Strong runtime protection for containers and Kubernetes (not just VMs).
* API-first design for automation, with good Terraform provider support.
* Ability to feed into or correlate with existing observability stacks (not just a siloed portal).
* A pricing model that isn't purely per-endpoint, maybe considering workloads or data ingest.
I've done some initial digging and have names like **Wiz**, **Aqua Security**, and **Palo Alto Networks Cortex XDR** on my list. Also heard murmurs about **Microsoft Defender XDR** (but we're not a deeply Microsoft shop). Has anyone made a switch or run a comparative POC?
I'd love to hear:
1. **What you switched to/from and why.**
2. **Any gotchas in implementation,** especially around container security.
3. **How you handle alert routing and automation.** Any cool scripts or workflows to share?
If you have code snippets for integrating alerts into, say, a Slack-Opsgenie-PagerDuty pipeline or for auto-remediation in Kubernetes, that would be gold. I'll start by sharing our current Vision One webhook processor (Python) in a reply.
Thanks in advance for your insights! Looking forward to a detailed discussion.
ā francesc
ā francesc