SentinelOne vs Malwarebytes for Teams Comparison

Easy to setup and S1 automatically puts the device that is suspects is infected in network quarantine. Also like the rollback feature.

Would like for it to have more days/months in history for threat hunting

I love how it is behavior based and doesn’t rely on signatures

There are multiple email alerts for each incident

I'm able to easily manage and customize our dashboard, pull reports and view analytics.

I wish we could create team dashboards for other users.

The responsiveness of the product to threats and ease of setup.

Abnormal deployment for a particular server was an issue and support was lacking.

I am generally more technical. so, using SentinelOne's visibility feature you are able to hunt down events on your endpoints. and create alerts based off custom queries. this was very flexible, and I was able to find multiple issues on endpoints just experimenting with their query language.

Helpdesk support sometimes was hard to deal with. alerting for custom rules was not very good.

I really like the ease of use with the software and how accurate it all is. It makes our daily IT lives a lot easier.

The cost of the product is a bit much for the upper tiers, but overall justifiable to some.

Very intuitive to use, not a big learning curve when configuring or rolling out new features. SentinelOne is always making product enhancements and overall just happy with the product.

There were some initial limitations with the firewall and blacklisting, but the enhancements have made up for this.

I like the detection response and the way it behaves. It doesn't just scan for malicious files, it looks for malicious behavior. It has protected clients/users from actual attacks.

Sometimes it does it's job too well, such as if you are just clearing out shadow copy data. But...things like that can be done in a malicious attack, so it's worth having to temporarily disable it from time to time. The updates fail sometimes and require a complete reinstall of SentinelOne and it can get a little difficult, sometimes requiring to use the cleaner tool and get into safe mode.

Quick and easy to use dashboard that is always clear about the required information.

Integrations can sometimes not always work as expected.

The ability to see what machines are protected over a period and their infection during said period is great.

Sometimes making changes and resolutions regarding infections is cumbersome and not always obvious. Also self-resolving could be easier to review and implement.

Simple to use, great detection rates, feature parity client for macOS and Windows.

Can be a bit resource intensive on the endpoints.

The software is very powerful and provides protection even for things you werent aware of.

Onboarding can be confusing as the repos and documentation do not always line up

We like everything about S1. Its a solid product with a big feature set and also with the ability to have active threat hunting and also managed detection and response added.

Its not the cheapest product in the world once you add all the features on, however thats the price you pay for good security.

The product is very easy to setup, and in most cases, it auto-remediates and is a setup-and-forget-it system. however, does have a lot of kinks

It has false positives often, does not have a full rollback feature for mac. The worst part is the detecting engine has a lot of false positives

- Easy to implement- Policies are easily customizable- Host Firewall is a great feature- Remote shells allows to quickly investigate incidents.

- Host Firewall should be improved to control web traffic.

Lightweight agent. Low false-positive rate. API and integrations.

Not yet integrated mobile platform into the XDR platform.

Highly effective, detects zero-day vulnerabilities, flexible configuration. Whitelisting catalog helps with common applications getting set up appropriately for customers.

As with other AI / Machine learning based solutions, there are false positives, and sometimes this can be tricky to get the proper exclusion in place.

The SentinelOne Deep Visibility is the most impactful feature of the software. It makes for an excellent threat-hunting exercise.

SentinelOne requires users to encrypt a threat file with a complex password before it can be downloaded. The complex password introduces a minor problem when assessing the malicious file locally. For instance, one might be tempted to use a browser-generated password to meet the password criteria, but this is difficult to remember and would always require one to check their saved passwords to enter correctly before one can commence an analysis of the threat file in a lab environment. It will be much easier if threat files are encrypted with a standard password of "infected" or at least allow users to use passwords like this instead of a complex one.

Easy to deploy. Agent is lightweight. Locked down our environment - internal pen-testers have trouble bypassing it. Has saved us a few times as users will be users and click on anything and everything. Has been rock solid for the past year. Happy with the purchase.

Sometimes it blocks things and it's tough to tell unless you really dig into it. Sometimes causes legit software to stop working until you whitelist. No automatic update for agents.

I like the way you can customize exclusions and alerts. I like the web console for endpoint management and the many options you have from there including taking an endpoint offline.

Navigating the web console is slow when you have many agents installed. Typically an endpoint reboot is required when you make any changes like a new exclusion, enable/disable the agent. This is not convenient of practical. Identifying the actual file or process that is the source of an alert can at times be challenging.

I love how easyer it is to use and the automated rediation, roll back and isolation features to do the work for me.

I wish that they had an auto update feature for agent versions. It does update the current version with needed things, but it does not update the installed agent to a new version. Have to push it out manually via the console.

It is easy to use, rates extremely highly in The MITRE ATT&CK, and has been very effective for out business as an EDR security solution.

It labeled a lot of in house non-signed programs as suspicious, but with some exception mapping that was handled very easily.

The AI and behavior based monitoring as well as the normal fingerprint. Visibility give you the ability to look at process story lines and see how a process was triggered.

There are some additional functions (like rogue devices) that sounded really neat, but they are not as useful to us as we thought they would be. We get too many notifications for them to be effective.

Autonomous response to threats regardless of being online of offline in connectivity to the management console. Ease of deployment and configuration. The simple UI with the access to the detailed product documentation, which provides comprehensive details needed for operations as well as troubleshooting. The support service, which responds rapidly and sorts out the issues within few mail correspondences.

They would require few feature additions in vulnerability management to compete with other leading vendors.

The deployment was incredibly easy on each machine and we really like the USB device monitoring to control external devices. The Daily reports are helpful for documentation/record-keeping purposes.

The activity dashboard can be a little complicated if you aren't a technical person. Same with the threat hunting rules. The layout isn't super friendly and has a learning curve of where everything is.