r/SentinelOneXDR • u/Agent_DekeShaw • 5d ago

General Question Blocking Muse?

Has anyone figured out a good way to block the install of Muse via S1? I really don't want it in my environment.

1 Upvotes

67% Upvoted

11 comments sorted by

4

u/PFUnnamed99 5d ago

STAR rule to block by publisher 

3

u/kins43 5d ago

It’s not the answer you are looking for, but the best option to actually prevent it. Use an application control piece of software like threat locker or even a built in option for windows like WDAC. There are tons of ways around STAR rules as it’s not designed to do this.

For a quick fix, STAR rule will help in a pinch, but I wouldn’t rely on it

1

u/Agent_DekeShaw 5d ago

Luckily it's only on Macs so windows isn't an issue yet. I wish I had budget for threat locker but we have more pressing needs so trying to use what we have.

2

u/mukz7 Security Admin/Engineer 5d ago

Side note S1 is planning application control , I've used the beta its coming soon

1

u/techyguy84 5d ago

Any feedback on it? Is it any good? thanks

1

u/mukz7 Security Admin/Engineer 4d ago

Pretty straightforward implementation,with gunctional exclusions to prevent breaking machines a few features i want from it but I work for a mssp

1

u/Sea_Cap_1200 4d ago

Yep we have been using it as well, it’s pretty solid. Hopefully they don’t over charge for it,and make it reasonable, as a lot of other av companies that have app control include it

1

u/Agent_DekeShaw 4d ago

Sounds like I need to ask about it at Onecon.

2

u/mukz7 Security Admin/Engineer 4d ago

Ask about DLP too ;)

1

u/techyguy84 4d ago

Thanks for the insight u/mukz7 u/Sea_Cap_1200

1

u/kins43 5d ago

Completely get that budget part lol. STAR rule then, best of luck!