Antivirus and exclusions

Yes, Stoïk strongly recommends uninstalling any existing antivirus or other EDR solution before installing your Stoïk MDR EDR (CrowdStrike or SentinelOne), in order to prevent any conflicts that could compromise the proper functioning of the solution.

CrowdStrike

The Stoïk teams have implemented a gradual three-phase deployment to limit the risk of blockages and the impact on user workstations, with phase 1 allowing you to install the EDR while keeping your antivirus or EDR in place. It is therefore essential to uninstall your previous antivirus or EDR solution before moving on to phase 2.

If you do not uninstall it before moving on to phase 2, a "blue screen" may appear when the workstation is restarted.

However, some antivirus or EDR solutions, whether single-use or multi-use, may cause blockages as early as phase 1 of the deployment. These solutions are listed later in this document.

SentinelOne

SentinelOne does not use a phased deployment: full protection is active as soon as it is installed. It is therefore essential to uninstall your previous antivirus or EDR solution before installing SentinelOne, to avoid any conflict.

Single-use antivirus

These programs have only one function: antivirus protection.

CrowdStrike

• Bitdefender: must be uninstalled during phase 1 of deployment. If you do not uninstall it, a blue screen may occur when you restart your computer.

• Trend Micro: must be uninstalled starting from deployment phase 2, otherwise error messages may appear.

• macOS: No known conflicts, no action required.

SentinelOne

• Bitdefender and Trend Micro: must be uninstalled before installation, since SentinelOne has no phased deployment.

• macOS: No known conflicts, no action required.

Multi-purpose solutions

These software programs offer several security functions in a single tool: antivirus, firewall, USB device control, integrated EDR, etc. Common examples include WithSecure, ESET, and Kaspersky.

CrowdStrike

Simply disable the antivirus functionality only, no need to uninstall the entire software.

For Windows Defender, there is no need to uninstall it; it is fully compatible with your EDR. It remains active in phase 1, and the antivirus engine is disabled automatically at phase 2.

SentinelOne

These solutions must be fully uninstalled before installing SentinelOne, since there is no phased deployment to tolerate a temporary conflict.

The only exception is Windows Defender: there is no need to uninstall it, it is fully compatible with SentinelOne, and the antivirus engine is disabled automatically as soon as SentinelOne is installed.

Beware of side effects on Windows:

If you completely disable the multi-purpose solution, and it previously managed your firewall, then:

• The Windows Firewall will automatically take over.

• However, it will apply its own default, very restrictive rules.

• This can completely block your network connections.

The solution is to reconfigure your local Windows firewall with the necessary rules and exclusions to restore the expected connections.

Example of an error message:

Exclusion rules

Managing application flows through exclusion rules is an approach specific to traditional antivirus solutions, but it does not apply to an EDR such as CrowdStrike or SentinelOne.

Difference in operation between antivirus and EDR

• Antivirus: proactively scans all dormant files on the system (whether executed or not). This generates a large volume of scans and requires numerous exclusions to avoid false positives on inactive files.

• EDR (CrowdStrike, SentinelOne): focuses only on files that are actually executed and on dynamic system behaviors (processes, connections, user actions, etc.). No continuous full-disk scanning is performed; inactive files are not analyzed except during manual scans.

Since an EDR analyzes suspicious behaviors rather than signatures, excluding a folder from analysis is unnecessary.

Excluding a folder would have a negative effect: if suspicious behavior were to occur in that folder, the EDR would not be able to detect it. That said, this remains technically possible if the need is validated by our SOC team.

Intelligent prevention and reactive exclusion management

Your EDR integrates a set of preventive mechanisms to limit false positives without manual intervention:

• Preconfigured exclusion lists are automatically applied during deployment.

• In the event of a suspicious detection involving a business application, the program is temporarily blocked, then analyzed by our SOC before any definitive action is taken.

To avoid potential unwanted business disruptions, full isolation is performed only manually, either after analysis by our SOC team or by you.

Exclusions should not be defined upfront

Trying to anticipate exclusions before any detection occurs represents a major risk:

• It amounts to preemptively excluding potentially malicious behaviors simply because they are associated with a known business application.

• Result: you risk neutralizing the EDR's detection capabilities, allowing certain attacks to go undetected.

At Stoïk, exclusions are handled only in response to a real detection, based on SOC analysis.

Conclusion

Exclusions in an EDR are far fewer and are applied only when a blocking event has actually occurred. It is neither necessary nor advisable to add "preventive" exclusion rules as you would with a traditional antivirus.

Concrete example: One of our clients (a national retail player) had more than 3,000 workstations and several thousand exclusions in their previous antivirus solution. After switching to an EDR, no exclusions were required.