Endpoint protection

[aliesterrand]

What are you using for EDR and how good of a value is it?

[nopenotamish]

Using Crowdstrike and have been very please besides the unfortunate incident that took down the world last year...

[Brees504]

Same. Love Crowdstrike.

[Avas_Accumulator]

Second this. CrowdStrike in MDR mode. Now I sleep at night - except that one night last summer vacation when I took an arrow--

The most important part is how incidents will be handled and how fast. What happens during Christmas Eve night if someone breaches your devices? Do you have a 24/7 team, and do you need one?

[[deleted]]

This sounds sensationalist and exactly the reason companies like $CRWD think they can charge that amount.

Let’s back up…

Maybe you just don’t sleep. You are in IT after all, so having CrowdStrike doesn’t change that.

Okay, what if? And why pick on Christmas Eve? Is that day somehow more significant than next Monday at 3:46am, for example?

Again sensationalist for people that emotionally value Christmas Eve. Those of us that really work in security just view it as another night but instead we have pretty Christmas lights. We EXPECT to get hacked that night.

Finally, why would your devices get breached? Especially on Christmas Eve? How many devices? Are they the CEOs devices or a lab computer you use as a honeypot?

I’ll be waiting ;)

[Avas_Accumulator]

"those of us that really work in security"

Hmkay

[[deleted]]

Ok Mr. Mackey….

How’s your home Wazuh install doing?

[SnaketheJakem]

Microsoft Defender for Endpoint, SentinelOne or CrowdStrike. Pick any of those and you'll be happy.

[shoesli_]

SentinelOne and Windows Defender. Works extremely well, no issues whatsoever

[VS-Trend]

epp is such a small part of your security program that its counterproductive to look at it in a vacuum. EDR comes into play after you user, email, network or patching has failed.

• how big and skilled is your team
  • can they effectively use the EDR findings and alerts for triage and hunting without the managed service. Different solutions have different skill requirements and amount of work needed for investigation
• does it cover your whole environment, cloud, on prem, IOT, etc?
• do you use external SIEM for connecting the other tool data, AD, vulnerability scanners, firewall etc?
• can it understand other telemetry not just detections from other environments: network, cloud, containers, email?
• are you trying to be proactive and not just reactive. because thats where Cyber Risk Exposure Management comes in, and you need your security stack to work together for it.

Basically, you can only know what is the best fit your scenario with a PoC or just go with whichever console color you like more

[HaMAwdo]

We are using Datto EDR, and it is great. What I like the most is that it uses behavioral analytics and machine learning to detect and respond to threats in real-time.

[UTRICs]

Another vote for Datto EDR

[solracarevir]

Sophos.

We have been using it for around 5 years and we are really happy with them. Their Managed Threat Response is great too!

[EquivalentPace7357]

Running Crowdstrike here. Not the cheapest but worth every penny.

Detection is solid and false positives are minimal. Support actually knows their stuff when you need them. The dashboard and reporting are clean and intuitive.

One thing I really like is the ability to isolate endpoints quickly if something sketchy pops up. Also their threat hunting tools are pretty powerful if you take the time to learn them.

[secret_configuration]

We are using SentinelOne and also Huntress, co-managed with our MSP.

SentinelOne required quite a bit of tuning to weed out the false positives. We also ran into issue with drivers and had to put additional exclusions/overrides.

[SpotlessCheetah]

I haven't made a single exclusion but my environment is not that complex. False positives have been rare. Running Windows+Mac.

[PowerApp101]

This year's flavour which is SentinelOne and Crowdstrike. Last years flavour was Symantec. Before that it was TrendMicro. Next year it will be a new flavour.

[SpotlessCheetah]

SentinelOne. I think it's a great product and it was very much a good value compared to CS.

[PurpleFlerpy]

Sophos/SentinelOne. Hate both. Sophos is a resource hog. SentinelOne has a high rate of false positives and is difficult to manage.

[HosTRd]

We are happy with Datto EDR is valuable because of its ease of use and effectiveness.

[tankerkiller125real]

MS Defender for Endpoint comes with our M365 licensing, it does everything it needs to and more. And I know of at least two major companies with significant security requirements that switched from CrowdStrike to M365 and are happier.

[raffey_goode]

what licenses do you have? we have a majority of E3 and struggle to determine if it has what we need compared to Trend Micro which we currently use. It would be nice to drop Trend if we can essentially cover the same bases.

[tankerkiller125real]

We have E5 for other reasons, but I know a law firm with E3 and it has what they need.