Disclaimer: My company is a DarkTrace partner.
That being said, I will not recommend anyone a solution that is not right for them.
With DarkTace, besides clever marketing and (personal opinion annoying UI), it does bring a lot to the table.
Not sure if they have bragged about it to you already, but the city of Las Vegas is actually using it to protect its infrastructure.
My early experience with ML/AI(ish) products started with LightCyber years ago, before they were gobbled up by PAN. Essentially an anomaly detection and alerting tool integrated with NAC to quarantine the compromised machines.
DarkTrace works on similar principles with advanced and evolving detection algorithms.
It does allow you to playback the incidents' progress, which is a very nice feature.
Things to note: If you are planning to rely on antigena for dynamic protection, for UDP traffic you'll have to integrate it with your existing firewalls, as by itself, it relies on TCP RST for isolation.
You may also consider splitting your monitored environment in two segments, one that is prone to relatively unpredictable pattern changes and one with the more established workflows.
Doing that will reduce the false-positives and you'll be more confident in turning the full auto mode on.
Overall, I think that either this or similar solutions are inevitable if we are to stand a chance of stopping evolving algorithmic exploits.
Regards,
Vladimir
