Battle deep instinct vs crowdstrike which one and why?

[Shadowra]

I'm reviving this topic, having uninstalled Deepinstinct from my personal computer 30 minutes ago!

It deleted: Brave, Filmora, an m3u player, a game, DeepL, UniGetUI. ....

 

[simmerskool]

I'm reviving this topic, having uninstalled Deepinstinct from my personal computer 30 minutes ago!

It deleted: Brave, Filmora, an m3u player, a game, DeepL, UniGetUI. ....

so far DeepInstinct has not misbehaved here (that I am aware of) -- I'm 6 or 7 hours west of you...

 

[danb]

I'm reviving this topic, having uninstalled Deepinstinct from my personal computer 30 minutes ago!

It deleted: Brave, Filmora, an m3u player, a game, DeepL, UniGetUI. ....

This is exactly why the user has to be involved in making the decision on whether to quarantine / delete a file or not.

To properly secure an endpoint, there should be a baseline layer with a moderate security posture and low false positives... in other words, your typical antivirus.

On top of the antivirus layer there should be a more aggressive zero-trust layer that involves the user or admin making the decision on whether to allow the item or not.

Aggressive cybersecurity products should never auto quarantine / auto delete, and moderate security posture products should never let or force the end-user make the final decision.

I have worked directly with end-users since 1999, some of them being the most novice of users, and I can tell you on no uncertain terms, this is the only way to properly secure an endpoint.

 

[Shadowra]

This is exactly why the user has to be involved in making the decision on whether to quarantine / delete a file or not.

To properly secure an endpoint, there should be a baseline layer with a moderate security posture and low false positives... in other words, your typical antivirus.

On top of the antivirus layer there should be a more aggressive zero-trust layer that involves the user or admin making the decision on whether to allow the item or not.

Aggressive cybersecurity products should never auto quarantine / auto delete, and moderate security posture products should never let or force the end-user make the final decision.

I have worked directly with end-users since 1999, some of them being the most novice of users, and I can tell you on no uncertain terms, this is the only way to properly secure an endpoint.

I know and I'm aware of that, but I'm pretty fed up with having to whitelist everything...

Thanks to @kamiloxf , I'm testing SentinelOne, which is more permissive, yet effective.

 

[Shadowra]

so far DeepInstinct has not misbehaved here (that I am aware of) -- I'm 6 or 7 hours west of you...

I tried again today, and it's fixed

(That'll teach me to read the security policies properly ^^ )

 

[Zero Knowledge]

I know and I'm aware of that, but I'm pretty fed up with having to whitelist everything...

But this the new cool for business/enterprise/home users, whitelisting is back with vengeance. Using enterprise tools will no doubt result in wrong quarantine objects.

The only thing you can do is submit a support ticket and hope they whitelist your banned programs!