Skip to content
Notifications
Clear all

Anyone actually using SentinelOne in production for a 500-user org?

1 Posts
1 Users
0 Reactions
0 Views
(@andrew8)
Estimable Member
Joined: 2 weeks ago
Posts: 78
Topic starter   [#21515]

We've been running SentinelOne Complete for 8 months across ~550 endpoints. Replaced a legacy AV. The data is straightforward.

**Deployment & Performance:**
- Agent footprint is ~150MB RAM on average, less than 1% CPU idle. No user complaints post-deployment.
- Initial full scan added ~5-7% network load for 48 hours. Post-baseline, network impact is negligible.
- We log all telemetry to our data lake. Average daily volume per endpoint is 1.2MB.

**Configuration (YAML snippet for reference policies):**
```yaml
policy:
script_injection: BLOCK
ransomware_mitigation: AGGRESSIVE
network_quarantine: true
log_level: INFO
exclusions:
- path: /opt/legacy_app/bin/
description: "Signed legacy vendor tool"
```

**Key Findings:**
* **False Positives:** Averaging 2-3 per week, mostly from in-house dev tools. Script control is the main trigger.
* **Containment:** 12 actual incidents. 9 were script-based threats contained automatically. 3 required manual review.
* **Management Overhead:** Console is functional. API is adequate for pulling threat logs into our ClickHouse cluster for correlation.
* **Cost:** ~25% higher than previous solution, but automated response justifies it.

Biggest hurdle was tuning exclusions for legacy line-of-business apps. The deep visibility is useful, but you need a process to handle the alert volume. Would like to see better native querying in the console; we export everything for analysis.


Numbers don't lie.


   
Quote