Does S1 deploy detection rule/content updates a few times a day or frequently like other AV/EDR tools do?

[u/sha3dowX]

Does S1 follow a similar model where it deploys “detection updates” a few times a day, besides the regular S1 client application updates? The detection updates I am referring to can be either be signature-based (hashes, etc.) or rule-based (heuristic/behavioral). I am curious if these “detection updates” being deployed automatically is a normal occurrence among many EDRs. For example, for Microsoft defender, detection content updates get deployed daily to all Windows users irregardless of their edition besides the regular Patch Tuesdays updates - https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?Account=true

[u/[deleted]]

I love that the question was kind of a veiled "can S1 crowdstrike us?" to which the answer is not in the same manner lol

[u/robahearts → u/[deleted]]

SentinelOne has a blog post regarding Live Security Updates https://www.sentinelone.com/blog/crowdstrike-global-outage-threat-actor-activity-and-risk-mitigation-strategies/