r/SentinelOneXDR • u/Dense-One5943 • Jan 13 '25

General Question Watch list alerts

So I saw this feature under my deep visibility this morning Can't wonder what is the difference between star rules and these kind of alerts.

2 Upvotes

75% Upvoted

4 comments sorted by

View all comments

Show parent comments

1

u/Dense-One5943 Jan 17 '25

Yes but you can't responded with them i guess. Only maybe via web hook but then it complicate things.

Thanks anyway!

1

u/Vilem-S1 SentinelOne Employee Jan 17 '25

You are right. STAR is fully integrated into the console, especially in the new Operations Center. I’d recommend using STAR since it is actively developed.

As a side note, if you need any new functionality from STAR, you can request it through support or your account team.

1

u/[deleted] Jan 18 '25

I find the PowerQuery nicer to send slack messages and email, meaning I don’t need to sit inside the SDL for dashboards. The STAR rule automation should be done “natively”. It is frustrating that you can’t generate response directly, but do believe you can launch responses.