Migrated from CrowdStrike to SentinelOne - 6 month report on what broke

We completed our migration from CrowdStrike Falcon to SentinelOne six months ago. I wanted to share a technical report on what we lost, what we gained, and the unexpected operational challenges that popped up. Our stack is AWS EKS with Terraform, so my perspective is heavy on cloud workload protection.

**The Good (Mostly)**
The behavioral AI detection in S1 is impressive. We've caught several novel container escape attempts that Falcon didn't flag. The Terraform provider for the S1 console is also more mature than Falcon's, which let us automate agent deployment policies cleanly.

**What Broke or Got Worse**
Our main pain points weren't in detection, but in integration and operations.

* **Cloud Security Posture Management (CSPM) Gap:** Falcon's integration with AWS GuardDuty and IAM analysis was a key part of our security posture. S1's CSPM feels like a separate, less-developed product. We had to rebuild this using Prowler and custom CloudWatch metrics.
* **Kubernetes Audit Log Monitoring:** Falcon's sensor had deep hooks into the Kubernetes API server audit logs. Replicating this with S1 required us to ship those logs to their platform via a sidecar, adding cost and latency. Here's a snippet of the extra fluent-bit config we needed:

```yaml
[INPUT]
Name tail
Tag k8s.audit
Path /var/log/kube-apiserver-audit.log
Parser json

[OUTPUT]
Name http
Match k8s.audit
Host ingest.us-1.sentinelone.net
Port 443
tls On
format json_lines
header Authorization Bearer ${S1_TOKEN}
```

* **Incident Workflow Automation:** Our SOAR playbooks, built around Falcon's `detection_id` and `hostname` fields, broke because S1's alert schema is different. The `agent_id` is the primary key, requiring a new API call to map to an instance ID. This added 2-3 seconds of lag to our automated response actions.
* **Cost Surprise:** While the base license cost was favorable, our bill for the Data Lake (extended retention and advanced search) grew unexpectedly due to the volume of enriched telemetry S1 collects by default. We had to tune data collection policies aggressively.

**Overall**
We're staying with SentinelOne for now—the core prevention is strong. But the migration was far more than a simple agent swap. It forced us to rebuild several ancillary security workflows and realize how much we'd relied on Falcon's broader (if sometimes clunky) ecosystem.

Has anyone else made this switch? How did you handle the CSPM and Kubernetes visibility gaps?

-- Amy