SentinelOne

Vorteile

SentinelOne was easy to deploy into our environment!

Nachteile

Honestly not a lot of issues, we like SentinelOne!

Vorteile

Overall, Sentinel One is easy to deploy, easy to monitor and has many features that other AV solutions don't offer or only include at a higher price-point. If Vigilance is added to the subscription, you will sleep better at night. It is pricey, but, knowing that you have a team that responds intantly to an incident is priceless. They can remediate, investigate, roll-back and many other things. This has made my job far easier and I do sleep better at night knowing that someone is always looking out for my environment.

Nachteile

During our initial deployment, we had several PC's that had to be reloaded from scratch. This occurred when we began our initial deployment of Windows 10 in our environment. The version we were using caused the OS to stop functioning. Re-imaging was our only option. We reported, and were asked to try a newer version. No further issues and we only had a small handful of PC's affected. Only one other con so far....price. Sentinel One is not cheap, but you get what you pay for.

Vorteile

Quick and easy to use dashboard that is always clear about the required information.

Nachteile

Integrations can sometimes not always work as expected.

Vorteile

Sentinel One is very simple in deployment all the resources are available easy to understand for even a new user. the built-in architecture is very simple and the rollout agent is easy to deploy or pushing with 3rd party tools.

When it comes to its XDR capabilities way ahead of all the traditional products, its Machine learning capabilities, and roll-back features, etc.. special comment for its storyline based on events and any incident that happens. Auto remediation capabilities are exceptional.

Nachteile

as the product has good capabilities but lack's in defining things deeply. building deep level policy fro endpoints or DLP based policy on products are limited.

Endpoint-specific policies are not so flexible and also not feasible for some customers because of their price.

Vorteile

I love how easyer it is to use and the automated rediation, roll back and isolation features to do the work for me.

Nachteile

I wish that they had an auto update feature for agent versions. It does update the current version with needed things, but it does not update the installed agent to a new version. Have to push it out manually via the console.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Gründe für den Wechsel zu SentinelOne

Vorteile

- Easy to implement- Policies are easily customizable- Host Firewall is a great feature- Remote shells allows to quickly investigate incidents.

Nachteile

- Host Firewall should be improved to control web traffic.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Gründe für den Wechsel zu SentinelOne

Vorteile

Excellent deployment, great team follow up with weekly deployment schedules.

Nachteile

Active Directory Ranger is not fully integrated.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Zuvor genutzte Software

Gründe für den Wechsel zu SentinelOne

Vorteile

We love how transparent S1 is. We get ZERO complaints about the software blocking or causing other headaches. We like how accurate the matching is and the automatic remediation it provides.

Nachteile

It's not free (just kidding). There isn't really anything to dislike about the product. You all are on the right track and honestly the only EDR worth replacing Microsoft Defender with after it's all said and done.

Vorteile

Easy to deploy. Agent is lightweight. Locked down our environment - internal pen-testers have trouble bypassing it. Has saved us a few times as users will be users and click on anything and everything. Has been rock solid for the past year. Happy with the purchase.

Nachteile

Sometimes it blocks things and it's tough to tell unless you really dig into it. Sometimes causes legit software to stop working until you whitelist. No automatic update for agents.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Gründe für den Wechsel zu SentinelOne

Vorteile

Great option and package. Have used it for a few years now and continue to be impressed with its capabilities. Continues to be developed and evolve as the threat landscape increases.

Nachteile

The additional add-ons get a little confusing as to what does what. Some of their terminology is a bit hard to determine initially.

Vorteile

I really like the ease of use with the software and how accurate it all is. It makes our daily IT lives a lot easier.

Nachteile

The cost of the product is a bit much for the upper tiers, but overall justifiable to some.

Vorteile

Very easy to use. Installation steps are easy to follow.

Nachteile

When whitelisting something that was flagged, it does something weird to the file path. The actual file path isn't whitelisted. You have to go in and manually change it.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Zuvor genutzte Software

Gründe für den Wechsel zu SentinelOne

Vorteile

S1 provides most if not all of the features of its competitors but at a much better price point.

Nachteile

Understanding the UI can be confusing and figuring out how to roll-out the software can be a little rough. I ended up using a 3rd party tool to roll it out.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Zuvor genutzte Software

Gründe für den Wechsel zu SentinelOne

Vorteile

SentinelOne helps protect our systems from both known and unknown threats. The ability to rollback changes make the product more powerful than traditional antivirus solutions.

Nachteile

Deployment of SentinelOne is definitely geared toward the experienced IT professional. The product takes time and experience to set up.

Vorteile

Highly effective, detects zero-day vulnerabilities, flexible configuration. Whitelisting catalog helps with common applications getting set up appropriately for customers.

Nachteile

As with other AI / Machine learning based solutions, there are false positives, and sometimes this can be tricky to get the proper exclusion in place.

Vorteile

The AI and behavior based monitoring as well as the normal fingerprint. Visibility give you the ability to look at process story lines and see how a process was triggered.

Nachteile

There are some additional functions (like rogue devices) that sounded really neat, but they are not as useful to us as we thought they would be. We get too many notifications for them to be effective.

Vorteile

It is really a pro software in finding out the vulnerability within endpoint, stay secure from threats, this can really save you from bad actors trying to put ransomware in your endpoint, your endpoint can easily be restored back to original state. Further we can integrate with SIEM and after observing the pattern we can have different threats use cases.

Nachteile

Nothing I can think of it really worked smooth when I used it, however they can improve the builds in each update, and yes threat actors are thinking out of the box, they also need to think out of the box and build something which can even prevent zero day attacks.

Vorteile

It has a low false positive rate and, in general, doesn't cause disruption to legit user activity.

Nachteile

It doesn't have a feature to scan offline AWS snapshots. We were wanting this feature because we have one legacy app that is very sensitive to any anti-virus scanning from any vendor and we wanted S1 to scan an AWS snapshot of the app server so we didn't have to install the agent and risk any performance issues.

Vorteile

This software is hard to circumvent. I love the quarantine/block options on nefarious files. The notifications work great and there's many options to configure. It's quite simple to manage and makes my job so much easier.

Nachteile

Sometimes the agent won't update on a PC. So it has to be manually uninstalledre-installed with special commands from SAFE MODE on Windows PCs. It's uncommon but it does happen.

Vorteile

I like its Reporting, Monitoring and Alerting capabilities

Nachteile

I think from an investigative standpoint, the deep dive search capability can be further improved.

Vorteile

The product is easy to use and has a great and easy dashboard.

Nachteile

It tends to take up a lot of processing resources on a PC.

Vorteile

Very effective detecting and eliminating threats. Users rarely noticed it was on their machines, which is definitely a plus. Never seemed to slow down machines either.

Nachteile

The admin panel is definitely a little confusing, especially at first. Could be made much simpler. Also, uninstalling this product off machines were sometimes a pain.

Vorteile

We were able to deploy the software with ease, single afternoon in testing for any necessary exceptions, and only 3-4 support tickets year 1&2. When was the last time you implemented a product with less effort?

Nachteile

Price but this is the first AV product I was involved in choosing/implementing from scratch. I can't speak to the cost other than it was much more than our previous solution but in time savings alone it has more than made up for this cost.

Vorteile

Features, protection, integrations, customer service

Nachteile

False positives via XDR, portal is a little confusing at times

Vorteile

Web dashboard, easy to perform everything

Nachteile

Sometimes it takes a day to perform a groups move

Vorteile

The agent is small and lightweight. Does not require constant web updating.
If perhaps you do get infected by Ransomware or a malicious malware. Worry not because the agent can perform a quick Rollk-Back event, Basically doing a System Restore to the last safe state. And Ransomware can't even overwrite or Damage system restore as SentinelOne takes over that service and space

Nachteile

They still haven't completely consolidated their Dashboards.
So depending on the SentinelOne product or packages you purchase you will unfortunately have to navigate multiple Dashboard. Other than that I have no things i can think of on SentinelOne

Vorteile

1. Its autonomous endpoint protection, powered by AI, offers unparalleled detection and response capabilities.
2. Reduces the manual working of the organization security team.

Nachteile

1. Sentinel One doesn't have any uninstaller tools, if in case any endpoint is not connected to the portal then you don't have the option to uninstall.
In the above case, the only option left is formatting the endpoint if you want to remove it from your endpoint.

2. Send what I want to highlight is that they don't have any knowledgebase available on google, how to configure, manage, etc.

3. The support team will take so long to resolve the issue.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Zuvor genutzte Software

Gründe für den Wechsel zu SentinelOne

Vorteile

Sentinel One is a top notch Cyber security product that saved one of our customers from a large wide Malware/virus threat. All machines that had S1 enabled were virus free and the other computers that were in transition were infected.

Nachteile

I the major con that I had issues with the S1 portal was deleting or uninstalling an endpoint or updating endpoints. I had to manually update agents and they weren’t updating on their own.

Vorteile

Its a very good product and provides overall security. I like most about behavior analysis using AI to detect and respond. Agent installation is easy and light on devices. Integration with our other tools is very good and was setup with no complications.

Nachteile

Some settings are complex and need extensive knowledge to understand and operate. Overall a good product.

Vorteile

Easy to deploy and install. Easy to make exclusions and other configurations.

Nachteile

Sometimes agent does not connect to cloud.

Vorteile

I like the detection response and the way it behaves. It doesn't just scan for malicious files, it looks for malicious behavior. It has protected clients/users from actual attacks.

Nachteile

Sometimes it does it's job too well, such as if you are just clearing out shadow copy data. But...things like that can be done in a malicious attack, so it's worth having to temporarily disable it from time to time. The updates fail sometimes and require a complete reinstall of SentinelOne and it can get a little difficult, sometimes requiring to use the cleaner tool and get into safe mode.

Vorteile

It stops almost all malwares and also we can remote in into the device. We can send broadcast messages which I really like.

Nachteile

It gives many false positives which sometimes are annoying.

Vorteile

Automatic deploy, automatic update, control panel easy to use

Nachteile

activation codes, are so long, easy to put wrong code

Vorteile

Lightweight agent. Low false-positive rate. API and integrations.

Nachteile

Not yet integrated mobile platform into the XDR platform.

Vorteile

actively monitors and protects against malicious theats; protected my computer from installing a malicious code editor.

Nachteile

Sometimes sentinelone does too good a job: it blocked me from installing iterm2 which is the standard macos terminal application. However, I was able to create a IT ticket and point them to the SentinelOne's quarantined folder and get the rules updated to allow for iterm2 installation.

Vorteile

The pricing is good for the quality of product you're purchasing, the detection is solid and picks up where other products might miss. Configuration and setup was intuitive and easy. Support has always been on top of whatever issues I have and resolves them quickly.

Nachteile

So far I have only had minor issues which their support has been quick to address. Thankfully we have had no major issues with it and it is working like it should!

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Gründe für den Wechsel zu SentinelOne

Vorteile

It monitors behavior, it thinks some legitimate software and commands are malicious, but also easy to reverse and continue on. Lots of options for whitelisting. Not easy to be removed, so it’s not easy to get around.

Nachteile

Sometimes I wish I could do VSS maintenance without having to disable the agent, but viruses and malware can attack VSS so I’m fine with it. Have had some issues with duplicating agents in the management side and trouble with updates.

Vorteile

Rileva le minacce utilizzando modelli AI, correla gli eventi benigni e malevoli facilitando l'analisi.

Nachteile

Molti eventi riportati sono falsi positivi.

Vorteile

We like everything about S1. Its a solid product with a big feature set and also with the ability to have active threat hunting and also managed detection and response added.

Nachteile

Its not the cheapest product in the world once you add all the features on, however thats the price you pay for good security.

Vorteile

It has best network and cyber security features
Comes with capable threat intelligence capabilities.

Nachteile

Nothing to complain about and SentinelOne has been helpful

Vorteile

Ease of deployment, reporting and containment.

Nachteile

As an administrator the web interface could be a little easier to remediate and disable agents when necessary.

Vorteile

Autonomous response to threats regardless of being online of offline in connectivity to the management console. Ease of deployment and configuration. The simple UI with the access to the detailed product documentation, which provides comprehensive details needed for operations as well as troubleshooting. The support service, which responds rapidly and sorts out the issues within few mail correspondences.

Nachteile

They would require few feature additions in vulnerability management to compete with other leading vendors.

In Betracht gezogene Alternativen

Gründe für den Wechsel zu SentinelOne

Vorteile

The price point to get the EDR values is the winning solution for us. Crowdstrike was considered multiple times, but S1 beat it in our review when taking in price/value concerns, not to mention the alert values were more spot on with "real" alerts that wasted our time much less. S1 also ties in with tons of other services in the cybersec world with it's API options.

Nachteile

The occasional alert that's false-postive or the pulling-network-cord feature on endpoints that don't appear to have a lateral spreading virus. (Rare detection flaw maybe). The biggest gripe would be years ago if the S1 software had some kind of internal database corruption, rebooting our domain controllers could nuke it from orbit... thankfully, this has not happened for over a year and we're very happy now.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Gründe für den Wechsel zu SentinelOne

Vorteile

tons of features but more importantly security. we never had any incident since we deployed sentinelone. rollback feature is awesome, threat hunting is very good and visualization of events with deep diving is something which helps to understand the overall threat landscape

Nachteile

only thing i don't like about them is their support is not locally available and they keep on introducing new features as a module with additional charges

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Gründe für den Wechsel zu SentinelOne

Vorteile

For the past one year am using this product . What i like the most is its ability to find vulnerability in endpoint systems and sudden disconnection form the local network, which makes the other systems in the network safe. It even finds the scripts running in the endpoint and helps us to identify potential security breaches.

Nachteile

Being a cloud service sometimes the web login is not available and also the frequent updation of the User interface makes it really confusing . When ever a system is blocked from network and if there is no internet connection for the system its to much difficult to restore he network , only thing that we can so is to uninstall the software and then connect the network.

In Betracht gezogene Alternativen

Warum SentinelOne gewählt wurde

Gründe für den Wechsel zu SentinelOne

Vorteile

I am generally more technical. so, using SentinelOne's visibility feature you are able to hunt down events on your endpoints. and create alerts based off custom queries. this was very flexible, and I was able to find multiple issues on endpoints just experimenting with their query language.

Nachteile

Helpdesk support sometimes was hard to deal with. alerting for custom rules was not very good.

In Betracht gezogene Alternativen

Vorteile

The most impactful feature of the product is the protection. If an incident is detected the device is immediately disconnected from the network and the team is notified via email. This kicks off a response process for my team to investigate and label as a true incident of a false positive.

Nachteile

I would say the only weakness of the product is the lack of ad hoc reporting. I have a need to create special reporting and there is not a feature to do that.

Vorteile

The ability to see what machines are protected over a period and their infection during said period is great.

Nachteile

Sometimes making changes and resolutions regarding infections is cumbersome and not always obvious.
Also self-resolving could be easier to review and implement.

Vorteile

Agent install - deployed to a PC - reboot and it's working. Web console filtering allows identification of incidents and configuration in a fairly simple manner.

Nachteile

Some upgrades of the product have introduced major issues. eg One release broke some OS upgrades on certain models of laptop leaving them unable to boot. Another version introduced crippling speed issues with Adobe products. To their credit they do eventually fix these issues, but not quickly enough.

Vorteile

It was easy to demo, test and deploy. The product shows info on the endpoints in a easy to read format.

Nachteile

None really. The main package had everything we needed.