Arista NDR vs. Darktrace

A Darktrace comparison to Arista NDR highlights the difference between the first generation of behavioral analytics approaches that relied on baselining to establish a "pattern of life" and the emergence of newer advanced network traffic analysis solutions. By simply using unsupervised learning to detect anomalous behavior, technologies like Darktrace generate a high volume of alerts, most of which are false positives, while also missing threats—false negatives. This occurs because modern IT environments are constantly changing for very legitimate business purposes. In other words, not every anomalous activity is malicious and not every malicious activity is anomalous. To compensate for these shortcomings, Darktrace customers face the constant operational challenge of "retraining". On the other hand, analyst firm EMA conducted an independent competitive review of network traffic analysis solutions and named Arista NDR the "Value Leader", ranking it #1 for time to value because of its frictionless approach that delivers answers rather than alerts.

Download a comprehensive breakdown in the Darktrace vs. Arista NDR guide and read an independent testing report from The Tolly Group comparing both solutions.

Data Arista NDR Darktrace
. Richness of Data Sources L2 - L7 network data BRO Alerts .
. Network Visibility Devices, Users, Applications,
External Networks, Organizations & Domains
Limited to IP Addresses
. Organizational Data Privacy Yes Yes
Data Science Arista NDR Darktrace
. Automated Entity Correlation . Yes . Limited
. Extracted Detection Features ~1200 ~300
. Security Knowledge Graph Yes No
. Behavioral Analytics . Yes . Limited
. Machine Learning . Yes . Limited
. Training Period hours 1-2 weeks
Use Cases Arista NDR Darktrace
. Detect Known Attacker TTPs . Yes Limited
. Retrospective Detection Yes Limited
. Encrypted Traffic Visibility . Yes . Limited
. Automated Campaign Analysis . Yes No
. Query Language & Threat Hunting . Yes . Limited
. Free Text Search No Yes
. Full Digital Forensics . Yes . No
Deployment & Extensibility Arista NDR Darktrace
. Deployment Considerations . Yes . Limited
. Integrations with other Security Tools . Yes Limited
. Supported Deployments Sensors: Physical, Virtual, and Cloud
Analytics: Physical, Cloud
Sensors: Physical, Virtual, and Cloud
Analytics: Physical, Cloud
. Threat Intelligence Integration Yes No
. API . Yes Limited


Customers looking for Darktrace alternatives, or a replacement, would do well to consider parameters ranging from the data being processed, or the data science being applied to the breadth of use cases supported. For instance, the use of an IDS engine like Bro (Zeek) under the hood represents the legacy approach for network traffic analysis. While it offers better efficacy than raw IDS alerts, it is still hamstrung by the fundamental shortcomings of a pattern matching approach that operates on network meta data such as IP addresses, ports, and protocols. As an alternative to Darktrace's approach, Arista NDR uses deep packet inspection and protocol parsing to first identify the actual entity and then categorize behaviors.

Darktrace primarily uses unsupervised learning to ascertain a device's "pattern of life". This approach, while an improvement on traditional detection approaches, still suffers from a challenge of being noisy since "patterns of life" change often for very legitimate business purposes–e.g. new software deployments, employee work habits, etc. In addition, this approach also fails when devices are already compromised before the "pattern of life" is learned. Arista NDR's algorithmic ensemble approach to learning compares against past behaviors, but also to similar entities and across the rest of the organization. This helps eliminate both the false positives and negatives that are rampant with solutions like Darktrace.

In addition, Arista NDR customers have access to a broader set of use cases in comparison to Darktrace. Arista NDR automatically provides a forensic timeline for any entity on the network, enabling investigations, incident response and proactive threat hunting. Importantly and unlike Darktrace, these capabilities (like the rest of Arista NDR's features) are also accessible through an API and via integrations with popular security technologies including SIEM, security orchestration, and endpoint security solutions.

All product names, logos, and brands are the property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.