SentinelOne Erfahrungen

It is really a pro software in finding out the vulnerability within endpoint, stay secure from threats, this can really save you from bad actors trying to put ransomware in your endpoint, your endpoint can easily be restored back to original state. Further we can integrate with SIEM and after observing the pattern we can have different threats use cases.

Nothing I can think of it really worked smooth when I used it, however they can improve the builds in each update, and yes threat actors are thinking out of the box, they also need to think out of the box and build something which can even prevent zero day attacks.

For the past one year am using this product . What i like the most is its ability to find vulnerability in endpoint systems and sudden disconnection form the local network, which makes the other systems in the network safe. It even finds the scripts running in the endpoint and helps us to identify potential security breaches.

Being a cloud service sometimes the web login is not available and also the frequent updation of the User interface makes it really confusing . When ever a system is blocked from network and if there is no internet connection for the system its to much difficult to restore he network , only thing that we can so is to uninstall the software and then connect the network.

I love how easyer it is to use and the automated rediation, roll back and isolation features to do the work for me.

I wish that they had an auto update feature for agent versions. It does update the current version with needed things, but it does not update the installed agent to a new version. Have to push it out manually via the console.

The product is very easy to setup, and in most cases, it auto-remediates and is a setup-and-forget-it system. however, does have a lot of kinks

It has false positives often, does not have a full rollback feature for mac. The worst part is the detecting engine has a lot of false positives

tons of features but more importantly security. we never had any incident since we deployed sentinelone. rollback feature is awesome, threat hunting is very good and visualization of events with deep diving is something which helps to understand the overall threat landscape

only thing i don't like about them is their support is not locally available and they keep on introducing new features as a module with additional charges

Overall, Sentinel One is easy to deploy, easy to monitor and has many features that other AV solutions don't offer or only include at a higher price-point. If Vigilance is added to the subscription, you will sleep better at night. It is pricey, but, knowing that you have a team that responds intantly to an incident is priceless. They can remediate, investigate, roll-back and many other things. This has made my job far easier and I do sleep better at night knowing that someone is always looking out for my environment.

During our initial deployment, we had several PC's that had to be reloaded from scratch. This occurred when we began our initial deployment of Windows 10 in our environment. The version we were using caused the OS to stop functioning. Re-imaging was our only option. We reported, and were asked to try a newer version. No further issues and we only had a small handful of PC's affected. Only one other con so far....price. Sentinel One is not cheap, but you get what you pay for.

- Easy to implement- Policies are easily customizable- Host Firewall is a great feature- Remote shells allows to quickly investigate incidents.

- Host Firewall should be improved to control web traffic.

We love how transparent S1 is. We get ZERO complaints about the software blocking or causing other headaches. We like how accurate the matching is and the automatic remediation it provides.

It's not free (just kidding). There isn't really anything to dislike about the product. You all are on the right track and honestly the only EDR worth replacing Microsoft Defender with after it's all said and done.

Easy to deploy. Agent is lightweight. Locked down our environment - internal pen-testers have trouble bypassing it. Has saved us a few times as users will be users and click on anything and everything. Has been rock solid for the past year. Happy with the purchase.

Sometimes it blocks things and it's tough to tell unless you really dig into it. Sometimes causes legit software to stop working until you whitelist. No automatic update for agents.

It was easy to demo, test and deploy. The product shows info on the endpoints in a easy to read format.

None really. The main package had everything we needed.

With a staff of 2 and over 150 employees and nearly 200 devices it is essential that we have XDR that is easy to use and as little work for administration as possible. SentinelOne delivers in spades. I can't say enough good things about this product.

It is a little on the expensive side of the solutions we have used in the past but so worth it.

Sentinel One is very simple in deployment all the resources are available easy to understand for even a new user. the built-in architecture is very simple and the rollout agent is easy to deploy or pushing with 3rd party tools.

When it comes to its XDR capabilities way ahead of all the traditional products, its Machine learning capabilities, and roll-back features, etc.. special comment for its storyline based on events and any incident that happens. Auto remediation capabilities are exceptional.

as the product has good capabilities but lack's in defining things deeply. building deep level policy fro endpoints or DLP based policy on products are limited.

Endpoint-specific policies are not so flexible and also not feasible for some customers because of their price.

The most impactful feature of the product is the protection. If an incident is detected the device is immediately disconnected from the network and the team is notified via email. This kicks off a response process for my team to investigate and label as a true incident of a false positive.

I would say the only weakness of the product is the lack of ad hoc reporting. I have a need to create special reporting and there is not a feature to do that.

Ease of deployment, comprehensive visibility into threats and threat lifecycles, amazingly versatile exclusion functionality.

Some of the desired features are not available in the Core SKU

I like the way you can customize exclusions and alerts.
I like the web console for endpoint management and the many options you have from there including taking an endpoint offline.

Navigating the web console is slow when you have many agents installed.
Typically an endpoint reboot is required when you make any changes like a new exclusion, enable/disable the agent. This is not convenient of practical.
Identifying the actual file or process that is the source of an alert can at times be challenging.

S1 provides most if not all of the features of its competitors but at a much better price point.

Understanding the UI can be confusing and figuring out how to roll-out the software can be a little rough. I ended up using a 3rd party tool to roll it out.

Very easy to use. Installation steps are easy to follow.

When whitelisting something that was flagged, it does something weird to the file path. The actual file path isn't whitelisted. You have to go in and manually change it.

I really like the ease of use with the software and how accurate it all is. It makes our daily IT lives a lot easier.

The cost of the product is a bit much for the upper tiers, but overall justifiable to some.

The responsiveness of the product to threats and ease of setup.

Abnormal deployment for a particular server was an issue and support was lacking.

This software is hard to circumvent. I love the quarantine/block options on nefarious files. The notifications work great and there's many options to configure. It's quite simple to manage and makes my job so much easier.

Sometimes the agent won't update on a PC. So it has to be manually uninstalledre-installed with special commands from SAFE MODE on Windows PCs. It's uncommon but it does happen.

Great option and package. Have used it for a few years now and continue to be impressed with its capabilities. Continues to be developed and evolve as the threat landscape increases.

The additional add-ons get a little confusing as to what does what. Some of their terminology is a bit hard to determine initially.

Finding a specific end point and the amount of information available is amazing. It's like endpoint protection and asset management all in one.

IT would be great to be able to push software installs or commands to endpoints.

I am generally more technical. so, using SentinelOne's visibility feature you are able to hunt down events on your endpoints. and create alerts based off custom queries. this was very flexible, and I was able to find multiple issues on endpoints just experimenting with their query language.

Helpdesk support sometimes was hard to deal with. alerting for custom rules was not very good.

SentinelOne helps protect our systems from both known and unknown threats. The ability to rollback changes make the product more powerful than traditional antivirus solutions.

Deployment of SentinelOne is definitely geared toward the experienced IT professional. The product takes time and experience to set up.

Excellent deployment, great team follow up with weekly deployment schedules.

Active Directory Ranger is not fully integrated.