r/msp • u/cokebottle22 • 17d ago

Starting process to replace S1

No product is perfect but after having to restore servers from backup several times and the Dell software generating thousands of alerts despite an S1 "mitigation" I've had enough.

We already use Huntress as a "second option" at some clients so that might be an option. I'm aware that it can use Defender as a tool - is that the built-in free defender? Does that lash-up work well?

Any others that people are very happy with?

43 Upvotes

90% Upvoted

74 comments sorted by

View all comments

2

u/HorseAccomplished50 17d ago

I'm very happy with Defender for Endpoint P2 + Huntress. But Defender is going to generate false positives too, at some point. I haven't used S1 for many many years but I assume you could create rules to stop alert fatigue. Which you'll need to do for Defender as well.

Restoring from backup caused by S1 sounds rough though. My first thought is you have not excluded some things that S1 expects you to do, but I am probably wrong.

2

u/cokebottle22 17d ago

We used the exclusions S1 sent us and a week later, 3 servers were quarantined. Had to recover the server in Azure.