7 ms·

What are some alternatives to CrowdStrike?

taspeotis 2y ago
Personal: Nothing - Windows Defender is built into Windows. Business: Nothing - Windows Defender Advanced Threat Protection is built into the higher Microsoft 365 license tiers. It amazes me people chose to pay money to have all their PCs bluescreen.
- neverrroot 2y ago
  This is a good example of very limited thinking.
- Aeolun 2y ago
  mdatp is also a virus. So slow…
  - taspeotis 2y ago
    It can record some telemetry to help you understand why it's slow: https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-performance-issues https://learn.microsoft.com/en-us/defender-endpoint/troubles...
- digitalsushi 2y ago
  if you had used 'some' before 'people' i could agree but some industries have to use a siem or they can be fined, so, i mean if there's a list of siems that are definitely not going to ever crash by messing around in the kernel lets get a list going
  - taspeotis 2y ago
    Microsoft Sentinel seems like a pretty unlikely candidate for SIEM to crash every machine it’s receiving data from.
  - willy_k 2y ago
    Luckily the concern isn’t simply whether they could make a mistake and cause a crash by easing around in the kernel, it’s whether they’re likely to, and I’d argue that CrowdStrike is particularly likely to do so given their testing and rollout processes, and the culture that encompasses those failures
- qaq 2y ago
  large orgs want something that will run across all of their fleet so linux servers, Macs etc.
  - taspeotis 2y ago
    Linux: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux https://learn.microsoft.com/en-us/defender-endpoint/microsof... macOS: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-mac https://learn.microsoft.com/en-us/defender-endpoint/microsof... It does iOS and Android too. Again, if you're an organisation big enough to care about single-pane-of-glass-monitoring you probably already have access to this via the Microsoft 365 license tier you're on.
worik 2y ago
> What are some alternatives to CrowdStrike? In house competence
- rnts08 2y ago
  But then you can't blame anyone else when shit hits the fan! Isn't that what you're really paying for with EDR? No one is safe from a targeted attack, regardless of software. /s
- duckmysick 2y ago
  Insurers often require to have Endpoint Detection and Response for all the devices, from a third-party. In-house often won't cut it, even if it makes more practical sense.
strunz 2y ago
Carbon Black was, though now they're owned by Broadcom and folded into Symantec
TillE 2y ago
Everything that describes itself as "endpoint security".
iamhamm 2y ago
SentinelOne

Personal: Nothing - Windows Defender is built into Windows. Business: Nothing - Windows Defender Advanced Threat Protection is built into the higher Microsoft 365 license tiers. It amazes me people chose to pay money to have all their PCs bluescreen.

neverrroot 2y ago
This is a good example of very limited thinking.
Aeolun 2y ago
mdatp is also a virus. So slow…
- taspeotis 2y ago
  It can record some telemetry to help you understand why it's slow: https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-performance-issues https://learn.microsoft.com/en-us/defender-endpoint/troubles...
digitalsushi 2y ago
if you had used 'some' before 'people' i could agree but some industries have to use a siem or they can be fined, so, i mean if there's a list of siems that are definitely not going to ever crash by messing around in the kernel lets get a list going
- taspeotis 2y ago
  Microsoft Sentinel seems like a pretty unlikely candidate for SIEM to crash every machine it’s receiving data from.
- willy_k 2y ago
  Luckily the concern isn’t simply whether they could make a mistake and cause a crash by easing around in the kernel, it’s whether they’re likely to, and I’d argue that CrowdStrike is particularly likely to do so given their testing and rollout processes, and the culture that encompasses those failures
qaq 2y ago
large orgs want something that will run across all of their fleet so linux servers, Macs etc.
- taspeotis 2y ago
  Linux: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-linux https://learn.microsoft.com/en-us/defender-endpoint/microsof... macOS: https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint-mac https://learn.microsoft.com/en-us/defender-endpoint/microsof... It does iOS and Android too. Again, if you're an organisation big enough to care about single-pane-of-glass-monitoring you probably already have access to this via the Microsoft 365 license tier you're on.

worik 2y ago

> What are some alternatives to CrowdStrike? In house competence

rnts08 2y ago
But then you can't blame anyone else when shit hits the fan! Isn't that what you're really paying for with EDR? No one is safe from a targeted attack, regardless of software. /s
duckmysick 2y ago
Insurers often require to have Endpoint Detection and Response for all the devices, from a third-party. In-house often won't cut it, even if it makes more practical sense.

strunz 2y ago

Carbon Black was, though now they're owned by Broadcom and folded into Symantec

TillE 2y ago

Everything that describes itself as "endpoint security".

iamhamm 2y ago

SentinelOne