Wondering if SentinelOne is a real company? Are they a viable solution?

[-]

Ekimup@reddit

I have a friend that has worked for them for a long time now, ever since they were a lot smaller of a business. As far as I know he loves it there. He’s talked about how it has grown over the years and how S1 differentiates itself from its competitors. It’s very much a real company.

Reply

[-]

OmegaThree3@reddit

Bro any chance you can check your DMs? Thank you so much.

Reply

[-]

greenwas@reddit

/u/ilikewines \- DM me if you still need help. I can put you in touch with their MS(S)P team.

Reply

[-]

thedatagolem@reddit

I use it now, and I also used it at my last job. I like it very much. MFA login to their customer console was sometimes tricky, but other than that it did great. That said, it's still signature-based detection. But the agent is lightweight and very powerful with a lot of attractive functionality.

Reply

[-]

xxbiohazrdxx@reddit

S1 is absolutely not signature based

Reply

[-]

secret_configuration@reddit

It sure is but not purely signature based.

Reply

[-]

thedatagolem@reddit

Enlighten me. How does it perform detection?

Reply

[-]

Aegisnir@reddit

Signature based? What? It’s an XDR. It looked for a multitude of things but it’s a ton of heuristics and checking processes. It’s a ton of machine learning and behavior analysis. Things like executables are scanned in real time so the second a process injection occurs it can kill it before anything happens. Automatic remediation and rollback too. Sure they have signatures just like every antimalware solution but it is in no way signature based. Go and read their documentation if you want but misinformation ain’t cool.

Reply

[-]

thedatagolem@reddit

> It looks for a multitude of things but it’s a ton of heuristics and checking processes. It’s a ton of machine learning and behavior analysis. Any chance you could provide something a little more substantive than "it just does stuff?" Because otherwise, this is all just marketing rhetoric. And at exactly what point in "real time" is it scanning executables? I hope you don't mean on disk or on the wire. A true non-sig based solution will sandbox the code and run it, looking for dangerous behavior *as it's running.* And S1 doesn't do that as far as I can tell. If I'm wrong (and I sometimes am) then post a link or something. But if you're going to call me out on misinformation, that kind of obliges you to supply the CORRECT information.

Reply

[-]

Aegisnir@reddit

You can go read their documentation. If that’s not specific I enough, get on a call with them and they can walk you through whatever you need. EDR by definition is not only signature based. It goes further using behavior based detection. If you don’t understand how that works, there are much more qualified individuals than I who can teach you.

Reply

[-]

thedatagolem@reddit

>You can go read their documentation. If that’s not specific I enough, get on a call with them and they can walk you through whatever you need. I've done both of those things. I understand it just fine. (And, unlike some, quite qualified.) It's the "R" in EDR that makes it different from traditional AV. And that has nothing to do with signatures and/or the lack thereof.

Reply

[-]

xxbiohazrdxx@reddit

Ah the rare "triple down"

Reply

[-]

thortgot@reddit

It's behavior based like every modern EDR. S1 has some "AI" (\*cough\*) that uses multiple sources of data on both the endpoint and cloud.

Reply

[-]

Essex626@reddit

Their software is really powerful. We had a customer with a ransomware incident a couple years back and SentinelOne stopped it and then allowed us to roll back the overwhelming majority of files that were encrypted. It really made what would have been a tedious process with a bunch of local data loss (obviously servers were backed up but some users had stuff on their computers) into a fairly easy one-day recovery. It does give more false positives or break other programs more often than some other AV I've used, but it's easy enough to identify and create exceptions.

Reply

[-]

Marrsvolta@reddit

Their incident response team is amazing. If you bring on a client who already has ransomware on their system, their incident response team will still help you remediate and identify the source of the attack. I find that level of support to be rare these days.

Reply

[-]

Aegisnir@reddit

They are one of the best EDR/XDR solutions out there. I have never had a problem getting a hold of anyone. They are like night and day compared to carbon black or crowd strike. They detect so few false positives it is absolutely insane. I used to spend hours every week in carbon black for false positives and this meant actual threats sat unattended until I could get through the queue of bullshit. Sentinel one had one false positive in the 2 years I have had it. Shit just works. It’s amazing.

Reply

[-]

robvas@reddit

We used their EDR software, pretty nice

Reply

[-]

acid_drop@reddit

same for us, very satisfied and priced right

Reply

[-]

ITBurn-out@reddit

Works well but their Dashboard is horrid and the exceptions can be difficult when it's a false positive.

Reply

[-]

enubra@reddit

It is a real company, for sure. We use S1 as a company AV solution and it works well. It was a little bit tricky to install a proxy for legacy computers, but we managed. Some false positive alerts, but there are nice dashboards and reports.

Reply

[-]

Key-Level-4072@reddit

Sentinel one is excellent. Pairs beautifully with Huntress. The API on SentinelOne makes it really easy to integrate with any existing tools you have for deployment, monitoring, response, and whatever else.

Reply

[-]

ScanGittman@reddit

We use them ever since our ransomware …incident. They are good. Definitely better than AV software alone. Doesn’t seem to use much resources. Uninstalling the agent can be a little tricky but you get used to it.

Reply

[-]

Brett707@reddit

The only issue I ever had with S1 was when it kept marking an old piece of software as a virus and locking it up. The issue was this was a mission-critical piece of software. When it locked it up it would bring that business to a screeching halt. We worked with S1 support for a few months. Never could get it to run so we ran regular AV on that one. The good thing was that software was on it's way out. Other than that it was a very good product and I found it to be easy to use.

Reply

[-]

ericsan007@reddit

if you are using Pax8, It is also available there.

Reply

[-]

chillzatl@reddit

They're one of the top endpoint protection products out there, effective and well regarded. I reached out via their contact us form a couple of months ago and heard back from someone before the end of that day. They have a contact us form and a "book time with sales" applet right on the front page. I'd suggest trying those.

Reply

[-]

gaybatman75-6@reddit

We use them for our IT solution across the companies we own but I haven’t worked here long enough to comment on whether they suck or not. If I had to jump through the hoops you’re going through I don’t think I’d trust my security to them.

Reply

Wondering if SentinelOne is a real company? Are they a viable solution?

Reply to Post

26 Comments

Ekimup@reddit

OmegaThree3@reddit

greenwas@reddit

thedatagolem@reddit

xxbiohazrdxx@reddit

secret_configuration@reddit

thedatagolem@reddit

Aegisnir@reddit

thedatagolem@reddit

Aegisnir@reddit

thedatagolem@reddit

xxbiohazrdxx@reddit

thortgot@reddit

Essex626@reddit

Marrsvolta@reddit

Aegisnir@reddit

robvas@reddit

acid_drop@reddit

ITBurn-out@reddit

enubra@reddit

Key-Level-4072@reddit

ScanGittman@reddit

Brett707@reddit

ericsan007@reddit

chillzatl@reddit

gaybatman75-6@reddit