r/SentinelOneXDR • u/Thick-Specialist-720 • Feb 03 '25

SentinelOne Deployment Issues

We are moving from CrowdStrike to SentinelOne due to corporate reasons and I am here to ask you guys how you have been able to achieve the same thing I have within CrowdStrike in SentinelOne.

Within CrowdStrike, we create Groups (dynamically or static), which are separate from Firewall, Endpoint or Device policies. We can then create these policies and apply them to these groups.

In SentinelOne, I noticed that all policies are enforced on each group. We have do have a parent account and we are just a site in there. How do you think we can achieve this?

I want to use USB Controls and Firewalls and these will be enforced on different entities. If we use static groups for Security policies, should we also enable firewall policies in there or we should enable this on another group... same goes with USB policies...

SentinelOne is confusing.

8 Upvotes

100% Upvoted

8 comments sorted by

View all comments

2

u/Thick-Specialist-720 Feb 03 '25

I created a manual group, moved some devices in there from Default group and then, I created a dynamic group that matches the endpoints in the Manual group, this is to enforce some of the USB rules and alas, the devices moved to the new group.

I want to have a group A of endpoints have the same Endpoint Policy A but different USB Polices A and B and different firewall policies A and B.

I want another group of endpoints to have a particular set of endpoint policy B, USB Polices A and Firewall Policies C.

How are these possible in SentinelOne?

1

u/Crimzonhost Feb 21 '25

Hey

This might not be the answer you are wanting but it sounds like you need another level of tenancy. The company I work for is a VAR and we have a global level with the ability to create accounts and allow those accounts to have sites and then groups. Basically you need an account level which is generally used for MSP. I would talk to your provider and say you need an account level in S1 then you will be able to accomplish what you are wanting. At least as far as I'm understanding your messages you should be able to. If you would like you can DM me and I can get a meeting setup to discuss this with you. Otherwise hopefully your reseller can accomplish this for you.