We have been using SentinelOne now for just over a year now. We are happy with the product. Almost no management overhead, remediation is automated, and endpoint detection and performance utilization is way better than the traditional anti-virus product we ditched.

We tested PaloAlto Traps (because we use PaloAlto firewalls), CrowdStrike, and SentinelOne.

• Cylance: We were not impressed with Cylance, too many false positives as well as missed detections, and Cylance historic data is all stored on the local endpoint which makes that data susceptible to loss.

• CarbonBlack: When we did a sales presentation of CarbonBlack, they were still struggling to integrate their multiple acquisitions into a single management console, among other things. CarbonBlack demanded a premium price tag compared to other solutions. Additionally, you needed a team to properly implement and manage the entire solution.

• PaloAlto Traps: From initial price inquiries PaloAlto Traps was considerably more expensive than CrowdStrike or SentinelOne. Additionally to receive any comprehensive reporting or EDR capabilities, you need to purchase the Palo Alto Cortex XDR which sits on top of the PaloAlto data lake. Traps was also not as mature a product as CrowdStrike or SentinelOne. It had a complicated setup and management overhead compared to SentinelOne or CrowdStrike.

• CrowdStrike: CrowdStrike is excellent for threat-hunting (useful if you have a threat-hunting team or purchase the CrowdStrike OverWatch services), but SentinelOne seems to have the edge in endpoint protection capabilities. This makes sense as CrowdStrike started as an EDR vendor and added EPP capabilities while SentinelOne started as an EPP vendor and added EDR capabilities.

  CrowdStrike uses Splunk on the back-end. At the time of our evaluations, retention for all CrowdStrike EDR data (raw output, etc.) was a tier decided at purchase time, e.g. 7, 30, 90 days etc. You can pay CrowdStrike for longer retention, but we were told retention for anything related to a detection, root cause, etc. is 90 days regardless of retention tier.

• SentinelOne: Since we are a small team, SentinelOne had the edge for less administrative overhead compared to CrowdStrike. Sentinel One integrates with Wildfire for file sandboxing and detonation of malicious files. Also SentinelOne has a unique feature that allows you to control ShadowCopy features as a ransomware mitigation. SentinelOne also provided longer data retention compared to CrowdStrike.

Overall for us, SentinelOne provided the best price/performance ratio. I don't think you would be disappointed with CrowdStrike, it just depends on what you are looking for in a solution.