Factorial IT installs your endpoint detection and response (EDR) agent on the devices it manages and shows you which of them are protected. Start here to pick the right EDR provider and the right deployment path.
Feature/Functionality
Overview
Four EDR providers are supported. Two of them install on their own once you switch them on; the other two rely on installers you upload yourself.
- ThreatDown (by Malwarebytes): deployed automatically across your fleet.
- SentinelOne: connect your SentinelOne instance and the agent is deployed automatically on macOS, Windows and Linux.
- CrowdStrike Falcon: deployed on macOS, Windows and Ubuntu from installers you upload.
- Bitdefender: the GravityZone agent, deployed on macOS and Windows from installers you upload.
Compare providers
| Provider | macOS | Windows | Linux | Deployment |
|---|---|---|---|---|
| ThreatDown | ✅ | ✅ | ✅ | Automatic, licence purchased through Factorial IT |
| SentinelOne | ✅ | ✅ | ✅ | Automatic, once your SentinelOne instance is connected |
| CrowdStrike Falcon | ✅ | ✅ | ✅ (Ubuntu) | Manual, upload the installers as custom software |
| Bitdefender | ✅ | ✅ | ❌ | Manual, upload the installers as custom software |
How to use
- Find your provider in the table above.
- Check that it covers the platforms you run.
- Open the article for that provider and follow its setup steps:
- Automatic providers (ThreatDown, SentinelOne) are switched on through a control in MDM > Controls.
- Manual providers (CrowdStrike Falcon, Bitdefender) are uploaded as custom software in MDM > Software.
Tips and Best Practices
- Check Linux coverage before you choose. Bitdefender has no Linux support here, and CrowdStrike Falcon covers Ubuntu only.
- Prefer an automatic provider if you want less upkeep. ThreatDown and SentinelOne need no installer uploads once they are enabled.
- Plan time for manual providers. CrowdStrike Falcon and Bitdefender need you to download installers from the vendor console and upload them before anything reaches a device.
Troubleshooting and FAQ
Troubleshooting
- Your provider does not show up as a control. Only ThreatDown and SentinelOne are deployed through controls. CrowdStrike Falcon and Bitdefender go through custom software.
- Linux devices are left unprotected. Check the table: Bitdefender does not cover Linux, and CrowdStrike Falcon only supports Ubuntu.
FAQ
-
Which providers install automatically?
ThreatDown and SentinelOne. CrowdStrike Falcon and Bitdefender need installers that you upload.
-
Can I buy a ThreatDown licence through Factorial IT?
Yes. ThreatDown deployment works with a licence purchased through Factorial IT.
-
What does SentinelOne need before it deploys?
Your SentinelOne instance must be connected first.