We’re deciding between Falcon and Wazuh + osquery for about 400 endpoints after a phishing-led lateral move last quarter; my concern is blind spots when laptops are off-VPN versus the operational load of tuning and upkeep. For those who’ve gone down either path, what compensating controls or playbooks helped you keep MTTD/MTTR within target without exhausting the team?
At 400 endpoints, the one thing that killed our “off‑VPN” blind spot was putting Wazuh/osquery behind a small public mTLS ingress (Nginx) and pointing osquery’s TLS logger + the Wazuh agent to it, with client certs pushed via Intune/Jamf (see https://osquery.io/docs/); endpoints report from anywhere and our MTTD stayed under 15 minutes. If you go Falcon, the contain‑host button will trim MTTR even more, but you’ll pay for the simplicity. Do you have MDM in place to handle cert rollout and rotation?
@ethan_gar72 +1 on mTLS ingress — what really cut our MTTD was to “treat silence as a detection”: if a host hasn’t checked in for 60 min we page, and at 4 hours we auto flip an Okta policy to step-up or block until the agent reappears, which covers the off-VPN gap without babysitting rules. Do you have an IdP you can wire that to?