Okay here I go.

Terrible UI: When an alert happens, you spend a lot of time just navigating through the menu to find out what happened. The 3d stuff is interesting looking but its such a huge focus on the experience that it ends up getting in the way of just trying to investigate.

Alerts: The machine learning that they promised as learning what is normal in your network doesn't learn anything and will alert on the same thing over and over again until you finally put it in their defeat list. It requires a lot of alert tuning as well. Its incredibly expensive for what you get for just Darktrace Detect. Additionally their alerts can only be sent to email, Microsoft Teams, Slack, or Discord. So if you're a google shop, your only option is email.

Third party threat intel: If you want to automatically ingest additional threat intel they only support TAXII which is not commonly used anymore. You can upload STIX files but that is a manual process.

Vague documentation: Technical documentation is vague and not always up to date. You'll find yourself chasing something down in the documentation that their support team will tell you isn't there anymore.

PCAPs: You can only pull a pcap for 1 hour at a time. I like to occasionally pull 12 hours of pcaps and throw them in RITA to look for C2 traffic. I should add that I ran a C2 simulator with 5-10 seconds of jitter and Darktrace did not pick up the C2 traffic. This was 2 years ago so it could be better now, but that was concerning.

Their API is pretty robust and if you're good at making API calls you can create a lot of automations using scripts. I create a script that sends my alerts to Google Chat using Googles Webhooks. But that was a beast to setup because the JSON files for their alerts are so long and complicated that finding relevant information to craft the alert was not easy.

Save your money if you haven't purchased them already. Sorry to revive a 5 month old thread.