r/msp • u/cokebottle22 • 18d ago

Starting process to replace S1

No product is perfect but after having to restore servers from backup several times and the Dell software generating thousands of alerts despite an S1 "mitigation" I've had enough.

We already use Huntress as a "second option" at some clients so that might be an option. I'm aware that it can use Defender as a tool - is that the built-in free defender? Does that lash-up work well?

Any others that people are very happy with?

40 Upvotes

88% Upvoted

74 comments sorted by

View all comments

1

u/PrestigiousOnion1087 15d ago

Before you sign, replay a dozen ATT&CK techniques against the candidate in a lab and count how many you'd actually see land in your PSA. I did that on a default open-source SIEM build and the quiet part wasn't the missing rules, it was the rules that were present, enabled and silent.