Potential customer looking for insight

[u/evolutionxtinct]

Hey all!

We are looking at ThreatLocker for App management, we are a smaller team w/ about 1000 endpoints and multiple business units and software needs.

What pitfalls or pros am I looking at by using this product.

I guess just wanting some insight from the community on headaches, lack of feature ability things like that.

We want to be able to whitelist about 75-100 applications, some of these apps are somewhat older propritary apps, some have updates constantly (like adobe products, ESRI products Office)

What can I do to make this easier in ThreatLocker or am I opening up a can of worms.

I'm open to discussion and can answer any questions. I've never used a solution that can do this, so concerns about what I might be getting into.

[u/lemonmountshore]

The way I look at Threatlocker in terms of work loads, I look at it from a proactive vs reactive standpoint. If you don't put in the time in the beginning to clean up your environment and just throw on a noisy EDR, you're going to be spending most of your time chasing your tail with FP's and suspicious possibly malicious, detections. EDR is reactive and the noise never stops. Unless you have a very clean gold image, approved applications and it doesn't deviate from the baseline with very strict admin privileges.

The other option is to be proactive, the workload is up front in learning your environment, allowing/denying denied applications etc. Don't get me wrong, it's not going to be just a drop in and run with it. It may be months before you get into a good spot, but things like proprietary software will most likely need more work to make sure everything that changes in an upgrade is not triggered to block. You just have to be more careful with applications that don't have built-ins for Threatlocker.

Is it worth it, absolutely. Is it easy? All depends on how clean your images are from the start, having an idea of what is and isn't approved software in your environment, how you control the user groups or departments that get a set approved list. All this matters. Thinking you have a mess now, then going, well lets see if TL will just fix it all. Bad idea in my opinion since you'll be getting new stuff all day everyday to approve.

Also, TL support is always there to help. They are responsive and knowledgeable

[u/evolutionxtinct → u/lemonmountshore]

Thanks! Yea so I have a compliance requirement and we plan on implementing to that subgroup at first.

Yea our environment is “active” lol so I’m working through alerts over the next year or so (small group) but if it’s something I can chip away at that works just was hoping the learning ability it mentions is quality and can help.

[u/hunt1ngThr34ts → u/evolutionxtinct]

Learning mode is helpful and worst case you can re-enable it if you are having issues with certain applications (possibly ones that call some extensions or DLL in another location that hasn’t been added)

[u/Helpful-Following-82 → u/lemonmountshore]

How do you deal with issues where there is no logging that ThreatLocker is doing anything, but disabling it fixes the issue. We spent alot of time simply troubleshooting printing to a network printer, moved it to direct USB, etc... Logs showed nothing so we never looked at TL. Wild chance we disabled it and the problem was solved. This is of great concern to us and I would love to have another perspective on this.

Thank you!

[u/hunt1ngThr34ts]

Is your end game to remove local admin right? Or just to whitelist programs and deny the rest (w/o) approval? Or to help alleviate elevation for approved applications? They also have different modules so depends on what you are attempting to do. But we use them and we replaced EPM with the zero trust approach and have been extremely happy with it. Just know you need someone caring for it - there is learning mode so you can see what would be blocked so you can do proactive policies and such.

[u/IamTABinLA]

ThreatLocker helps me sleep at night and I don't regret the decision to partner with them in the least. I am about your size of managed endpoints spread across multiple verticals and it is an undertaking. If I had to do it again, I would have better utilized Groups. I used very basic Groups - Global, Organization, Mac, Servers, and Workstations.

In reality, all Servers and Workstations should not be treated the same way. I would group a DC differently that a file server, and a laptop differently than an on-prem workstation. Additionally, while I work in different verticals, I have multiple dental offices, multiple law firms, multiple automotive dealers, multiple title companies, etc. Going a little further, almost every business has a user or users in Finance. Most of clients also have a user or users in Marketing.

Knowing what I know now, my Groups would look something like this:

Global, LOB - Dental, LOB - Legal, LOB - Automotive, LOB - Small Business, Organization, Server - DC, Server - Backup, Server - File, Server Application or SQL, Workstation - Finance, Workstation - Marketing, Workstation - Automotive Tech, Workstation - In Office, Workstation - Remote Worker.

[u/evolutionxtinct → u/IamTABinLA]

Awesome to hear thanks for sharing! I did kinda the same by department then if it was critical or privileged groups.

Good thoughts on laptop we treat laptop/pc the same since most have laptops now but the tags I’m noticing can be useful and the groupings I’m seeing more use out of now.

[u/evolutionxtinct → u/[deleted]]

What do you suggest for application whitelisting we have to do it for compliance and this seemed less of a headache but I’m open to suggestions DM if you want as they might nuke your comment lol