Hi all, new to the security side of things. I've been setting up our monitoring with Grafana/Prometheus and now looking at endpoint protection.
We're a ~200 user finance company, mostly Windows, some Mac. Need to pick between SentinelOne and Microsoft Defender for Endpoint. Leaning towards Defender because we're already on Microsoft 365 E5.
But I keep hearing S1 is lighter and has better threat hunting. Is that still true? Our priority is solid protection without killing performance for the traders.
From my monitoring tests, I saw Defender add some latency. Here's a basic query I ran on a test box for CPU impact during a full scan:
```promql
avg(rate(windows_cpu_time_total{instance="test-pc", mode="user"}[5m])) by (instance)
```
Would love real-world experiences, especially around:
- Ease of management at this scale
- Integration with existing SIEM (we're looking at Sentinel)
- False positives in a controlled environment
Thanks for any insights.