4 ms·

This only affects organisations that don't contribute back into the community - leechers in otherwords. Virustotal has always been a platform whose data is enr

This only affects organisations that don't contribute back into the community - leechers in otherwords. Virustotal has always been a platform whose data is enriched by the community for the benefit of all and so Cylance, Crowdstrike, etc can frankly go suck balls if they don't want to contribute.

newjersey 10y ago
Sentinel One's position didn't make sense to me. > “We were more than willing to work with them, but they didn’t have a way for us,” said Tomer Weingarten, chief executive of SentinelOne, a firm that acknowledges it was cut off from the feed against its will. “This is a step back.” > Weingarten said SentinelOne had added a new data feed to replace VirusTotal and predicted that VirusTotal will become less relevant as companies are excluded. Even Microsoft's offering has an "advanced membership" through which they encourage users to share specimen of detected suspicious activity back to the mother ship. If Sentinel One can detect, they should be able contribute back? > The company claims to have a number of customer wins with a malware detection rate of over 90% for zero-day threats. https://en.wikipedia.org/wiki/SentinelOne https://en.wikipedia.org/wiki/SentinelOne What are they saying?
- The_Magistrate 10y ago
  SentinalOne probably approached VirusTotal with specific requirements about how they wanted to contribute back, and VirusTotal said 'you can contribute the same way everyone else does.' The rest is marketing BS.
- iancarroll 10y ago
  It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.
  - pandemicsyn 10y ago
    Yup, that seems likely. Their whole shtick is that signature based checks don't cut it and that their behavior based system is the way to go. https://en.wikipedia.org/wiki/SentinelOne#Technology https://en.wikipedia.org/wiki/SentinelOne#Technology https://www.sentinelone.com https://www.sentinelone.com
  - sjg007 10y ago
    Sure but then generate a signature and submit it.
    - iancarroll 10y ago
      It's not really that easy...
      - sjg007 10y ago
        It's not that hard.

newjersey 10y ago

Sentinel One's position didn't make sense to me. > “We were more than willing to work with them, but they didn’t have a way for us,” said Tomer Weingarten, chief executive of SentinelOne, a firm that acknowledges it was cut off from the feed against its will. “This is a step back.” > Weingarten said SentinelOne had added a new data feed to replace VirusTotal and predicted that VirusTotal will become less relevant as companies are excluded. Even Microsoft's offering has an "advanced membership" through which they encourage users to share specimen of detected suspicious activity back to the mother ship. If Sentinel One can detect, they should be able contribute back? > The company claims to have a number of customer wins with a malware detection rate of over 90% for zero-day threats. https://en.wikipedia.org/wiki/SentinelOne https://en.wikipedia.org/wiki/SentinelOne What are they saying?

The_Magistrate 10y ago
SentinalOne probably approached VirusTotal with specific requirements about how they wanted to contribute back, and VirusTotal said 'you can contribute the same way everyone else does.' The rest is marketing BS.
iancarroll 10y ago
It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.
- pandemicsyn 10y ago
  Yup, that seems likely. Their whole shtick is that signature based checks don't cut it and that their behavior based system is the way to go. https://en.wikipedia.org/wiki/SentinelOne#Technology https://en.wikipedia.org/wiki/SentinelOne#Technology https://www.sentinelone.com https://www.sentinelone.com
- sjg007 10y ago
  Sure but then generate a signature and submit it.
  - iancarroll 10y ago
    It's not really that easy...
    - sjg007 10y ago
      It's not that hard.