EDR solutions have been around for a long time, and we think it’s safe to say that without it you’re pretty much blind to what goes on on your endpoints. In the last few years there has been quite a consolidation of vendors in the Gartner End Point Protection Quadrant, yet the most common question we still hear is: Which EDR solution is the best?

In this article we’ll have a look at SentinelOne and how Jarviss is leveraging and extending its Managed XDR services with SentinelOne.

 

Automation is Key

Automation is more than just an answer to the shortage of qualified cyber security staff every company is dealing with. It makes sense to automate repetitive tasks, however there are other reasons why we believe strongly in automation.

• Consistent Response: Anything automated is going to follow the same process step by step, every single time. No room for human errors, no chance of overlooking an alert. At Jarviss we take this one step further and provide our managed XDR customers with one-click remediations well outside of the SentinelOne eco-system.
• Timely Response: Being able to respond quickly and accurately to threats can be the difference between an isolated incident or a corporate wide breach. The longer the attacker is allowed to roam around in the victim environment, the bigger the damage and the harder the recovery. By automating response actions, the time to response is drastically reduced.
• Extending the ecosystem: Having endpoint telemetry goes a long way, but having context outside of what happened on the endpoint is what makes the difference between a stand-alone alert or an actionable one. By automatically pulling in live data from other systems, we enrich the incidents with network telemetry (NDR, Firewall), Active Directory, Threat Intelligence, Sandboxes, Identity and Authentication services.

This approach not only gives the analyst a better idea of what’s going on, it also allows for automated actions on 3^rd party network and security solutions – without needing to be an expert on how to configure them.

 

Why We Choose SentinelOne

SentinelOne really shines when it comes to its ability to automate, as it’s been built from the ground up on its own full featured API.

Although at Jarviss we have our preferences when it comes to EDR solutions, SentinelOne has been a strategical choice from the beginning. Our managed XDR services are pretty agnostic when it comes to technology, but we believe that highly accurate detections allow for safe automated response.

Sentinel One’s own AI-based behavioral detection and protection capabilities already do a lot of the heavy lifting when it comes to stopping attacks cold. We simply elevate this by providing extra context and allowing SentinelOne to automate response actions on other 3^rd party network, security and identity management systems, taking away the complexity of having to configure these manually and by eliminating human errors.

 

So Which EDR is the Best?

You can compare features, MITRE tests, ease of use, endpoint OS coverage and others. But we believe the capability to really integrate and automate your EDR solution is what will really give you exponential value when it comes to dealing with endpoint based threats. Being able to interpret the output from your EDR (automatically enriched with identity and network telemetry) and to take single-click action with confidence, is what will provide your with proper security, and not just a sense of security.

 

Already a SentinelOne Customer, What Jarviss Brings to The table.

So you already have SentinelOne, how well integrated is it in your environment, do you even have the people and time to develop this yourself?

Jarviss Managed XDR can provide you not only with SOC monitoring, but leverages your other network and security solutions to

• Automatically enrich SentinelOne incidents providing you with more context and allowing for more confident response actions.
• Provides playbooks and integrations with other systems (Active Directory, MFA, Sandboxes, Firewalls, NDR, etc …). No need to develop or maintain these integrations in-house.
• One-click remediations with Jarviss’s on-premise SOAR solution. No need to log into product consoles or needing technical expertise to contain a threat.
• If it has an API we can integrate it – we support other EDR solutions and can make custom integrations to systems in your environment.
• Recurring security meetings with your IT team to review incidents, enhancements and improvements in the network and cloud environment.

 

 

Are you interested in knowing more about Jarviss Managed XDR. Send us an email at info@jarviss.be or give us a call at +32 9 394 99 11.

 

Author: Luk Schoonaert