We've been running SentinelOne Complete for 8 months across ~550 endpoints. Replaced a legacy AV. The data is straightforward.
**Deployment & Performance:**
- Agent footprint is ~150MB RAM on average, less than 1% CPU idle. No user complaints post-deployment.
- Initial full scan added ~5-7% network load for 48 hours. Post-baseline, network impact is negligible.
- We log all telemetry to our data lake. Average daily volume per endpoint is 1.2MB.
**Configuration (YAML snippet for reference policies):**
```yaml
policy:
script_injection: BLOCK
ransomware_mitigation: AGGRESSIVE
network_quarantine: true
log_level: INFO
exclusions:
- path: /opt/legacy_app/bin/
description: "Signed legacy vendor tool"
```
**Key Findings:**
* **False Positives:** Averaging 2-3 per week, mostly from in-house dev tools. Script control is the main trigger.
* **Containment:** 12 actual incidents. 9 were script-based threats contained automatically. 3 required manual review.
* **Management Overhead:** Console is functional. API is adequate for pulling threat logs into our ClickHouse cluster for correlation.
* **Cost:** ~25% higher than previous solution, but automated response justifies it.
Biggest hurdle was tuning exclusions for legacy line-of-business apps. The deep visibility is useful, but you need a process to handle the alert volume. Would like to see better native querying in the console; we export everything for analysis.
Numbers don't lie.