Computer Help for Midsize Companies

SentinelOne's Singularity product line is a subscription-based, cloud-centric cyberthreat defense stack that includes AI software and advanced services to deliver comprehensive endpoint detection and response (Singularity Control and Complete) and managed detection and response (Singularity Complete with Vigilance MDR). SentinelOne's compact software agents can be loaded in a few minutes to guard popular endpoints against increasingly sophisticated threats including ransomware, familiar and new malware, trojan viruses, hacking tool sets, memory exploits, script misuse, invasive macros, and living-off-the-land (LotL) abuse. Singularity agents are offered for Microsoft Windows, macOS, Linux, and Kubernetes endpoints. Compatible form factors include physical, virtual, VDI desktops, hybrid data centers, and cloud service providers. Because SentinelOne software agents operate autonomously, they can provide cutting-edge behavior-based protection in real time even if endpoints are disconnected from the cloud.

Progent is a certified SentinelOne Partner and dealer and manages thousands of endpoints secured by SentinelOne technology. SentinelOne is invariably the initial endpoint response software activated by Progent to gain control and visibility of a customer's system at the outset of a ransomware breach. SentinelOne Singularity is in addition the root technology behind Progent's Active Security Monitoring (ASM) managed services. SentinelOne was recognized as a leading visionary in Gartner's 2022 Magic Quadrant for Endpoint Protection Platforms and scored the highest number of analytic detections in real-time with zero delays during the 2022 MITRE ATT&CK Phase 4 Evaluation. Gartner concludes, "This reaffirms its (SentinelOne's) ability to detect all attacks and provide full details of the techniques and tactics used." SentinelOne also outscored all competition for every use scenario in Gartner's assessment of Critical Capabilities for Endpoint Protection Platforms (EPPs).

Singularity Bundles for SentinelOne Endpoint Detection and Response
SentinelOne's Singularity product line has several levels of endpoint security product packages provided as a worldwide cloud-based solution that delivers high availability, hierarchical policy management, AI driven malware intelligence, rapid restoration, and an information-driven dashboard for security analytics. Packages include Control for enhanced management, Complete for smart forensics, and Complete with Vigilance MDR for 24/7 advanced monitoring and response. The tiers are additive. Control and Complete each include all the features and options of the tier below it. Subscription rates starts at $10 per endpoint per month for small customers with significant discounts for larger accounts. Progent has no minimum device count.

The SentinelOne Control Package
The SentinelOne Control Package is the base software and is 100% maintained by the client. For some examples: Endpoint agents need to be updated in the SentinelOne portal, allow rules need to be set, exclusions need to be made, blacklists should be created, threats must be responded to, and many other day-to-day activities that someone in your organization needs to manage and maintain. SentinelOne is just like any other security product in that it has frequent updates to keep its defenses current. Progent can assist with or directly handle these items, but there is additional time and materials billing for all services performed.

With the Control Package you manage your own portal and while Progent and SentinelOne personnel are monitoring and or receiving alerts of serious threats in your environment, we have no authorization to do any work in your environment and will only do best efforts to alert you in case of a serious threat.

Features of the SentinelOne Control Package include:

• Endpoint Prevention (EPP) to block a wide variety of malware, Trojans, hacking tools, and ransomware before they start
• ActiveEDR Basic for Endpoint Detection and Response works in real-time with or without cloud connectivity. ActiveEDR identifies the latest malware, memory exploits and other fileless assaults as they try to do compromise your network.
• ActiveEDR Recovery gets users up and running in minutes and features full repair plus rollback for all supported versions of Microsoft Windows.
• Device Control for Policy-based control of all USB and Bluetooth devices (Windows, Mac)
• Firewall Control for Policy-based control of network connectivity to and from assets, including location awareness (Win, Mac, Linux)
• Vulnerability Management, in addition to Application Inventory, for insight into 3rd party applications with recognized vulnerabilities mapped to the MITRE CVE cybersecurity database
• Full Secure Remote Shell support for direct endpoint connection by event responders and forensics personnel
• Autonomous SentinelOne agent Storyline Engine
• Integrated Static AI and SentinelOne Cloud Intelligence file-based attack prevention
• Behavioral AI fileless incursion detection
• Autonomous Threat, Remediation, and Rollback
• Quarantine endpoint from system, Incident Analysis, Agent Anti-tamper, Application inventory
• Rogue device discovery

• Co-Managed solution with Progent being sent alerts and notices of all activities in your system. Clients are responsible for resolving threats in their system and extra-cost assistance time and material is offered from Progent's security experts
• ActiveEDR Advanced adds visibility of all benign data.
• ActiveEDR Advanced provides enterprise threat hunting. SentinelOne is differentiated with the ease-of-use characterized by the active nature of the solution in autonomously responding to threats.
• Storyline technology for Automated Forensics and fast root cause analysis (RCA). All OS stories are automatically contextualized with SentinelOne’s proprietary TrueContext technology, streamlining analysts' tedious task of event correlation so they can determine root causes with reduced MTTR.
• Storyline Active Response (STAR) mitigates zero-day threats with customized detection and hunting rules.
• Deep visibility Storyline Pivot and Hunt by MITRE ATT&CK technique
• EDR Hunting Data retention from 14 days standard to one year optional
• Timelines, file fetch, file integrity monitoring, sandbox integrations
• Other response options are available and personalized to your needs. Includes an hour of training in key features and routine management of the SentinelOne portal. During this training, Progent will demonstrate the creation of Exclusions, Blocklists, Mitigation, Agent Updates, Notifications, Client Reports, Application Features, Activity Logs and UI configuration Alerts.

Complete with Vigilance Respond Managed Detection and Response (MDR) Services
Vigilance Respond and Vigilance Respond Pro are optional Managed Detection and Response (MDR) programs for subscribers to SentinelOne's Singularity Complete bundle. These packages include full 24x7x365 incident response delivered by Tier-1, Tier-2, and Tier-3 cybersecurity experts. Vigilance Respond subscriptions include confirmation of cyberthreats, event prioritization, false positive management and dashboard updating, accelerated threat resolution, thorough reporting, service level agreements, and escalation back to the customer's cybersecurity organization.

Vigilance MDR consultants rank detected threat notifications based on a threat-handling hierarchy going from Benign False Positive to Malicious Urgent. This ranking dictates how the Vigilance analyst responds to the detected threat. There are five categories of threats and associated responses. The majority of alerts do not require action by the customer.

Benign Alert - False Positive
Vigilance takes care of the issue and annotates the SentinelOne dashboard. For isolated False Positive alerts, no additional responses or alerts are required. For persistent False Positive alerts, Vigilance will escalate the issue to the client to submit or agree to an appropriate exclusion or agent update as needed.

Malicious Alert - True Positive Non-Urgent, Potentially unwanted Program
Vigilance takes action to make sure the threat is blacklisted, resolved, and annotated. Usually, no notification will be sent to the customer unless the threat requires follow up activity.

Malicious Alert - True Positive / No Action Needed
Vigilance takes appropriate actions including remediation to make sure the threat is quarantined. After the analyst verifies the threat is deleted, the analyst will transmit a confirmation alert to the customer.

Malicious Alert - True Positive Non-Urgent / Action Needed
Vigilance takes proper actions including remediation to ensure the threat is quarantined. Once the SentinelOne analyst confirms the threat is eliminated, the analyst will transmit a verification alert to the client. Subsequent procedures like re-imaging may be required in some circumstances.

Malicious Alert - True Positive Urgent / Action Needed
Vigilance may react strongly in high priority breach cases including taking agent remediation actions and disconnecting compromised network devices to isolate the attack and prevent further lateral movement and spread. The analyst will transmit an urgent alert informing the customer of the issue and request immediate response.

In addition to providing all the functions of SentinelOne Control and SentinelOne Complete, SentinelOne Complete with Vigilance MDR adds 24x7 Monitoring with Immediate Threat Response, Remote Script Orchestration, and Ranger:

• Co-Managed Solution with Progent seeing alerts and notifications of all threats and activities in your environment and combined SOC response, providing 3 levels of 24x7x365 Detection and Response. All threats are mitigated and responded to in close to real-time. Further remediation options after threat mitigation are available and customized to your individual requirements.
• Remote Script Orchestration empowers enterprises to send scripts to a single machine, a few hundred machines, or even millions of machines, to respond to current and future cyberattacks at machine speed. Security Teams can send customized scripts or pick from a wide selection of jobs – ranging from incident response to forensics artifact collection and even network administration. In conjunction with SentinelOne Storyline Active Response, analysts benefit from automated workflows that promote incident response to a higher level.
• Ranger enables unmatched visibility into your system. Ranger is network-efficient by intelligently designating a small number of SentinelOne agents per subnet to undertake network mapping activity. Selected "Rangers" passively listen for network broadcast data such as ARP, DHCP, and other network observances. Admins can tailor active scan policies and select multiple IP Protocols for learning including ICMP, SNMP, UDP, TCP, SMB, and others. Rangers correlate all collected information in the backend to characterize familiar and unknown devices. Ranger device inventories show what is connected to your environment, where they are connected, and what protocols the devices listen on. Ranger enables you to discover and eliminate SentinelOne Agent deployment gaps using Ranger Deploy, a peer-to-peer deployment (Windows, Mac, Linux). Ranger permits you to determine how unfamiliar devices communicate with managed hosts and quarantine suspect devices from managed devices with a single click.

Download Progent's SentinelOne Singularity Packages Datasheets
Download datasheets describing Progent's SentinelOne Singularity packages:

• Overview of Progent's SentinelOne Singularity Packages (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Control Package (PDF - 210 KB)
  

• Progent's SentinelOne Singularity Complete Package (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Complete with MDR Package (PDF - 223 KB)
  

The Progent Advantage
Progent's team of more than 150 consulting professionals includes experts in every aspect of network technology associated with small and mid-size organizations. With this breadth of expertise, Progent can be your single point of contact for integrating a comprehensive security environment that offers significant business value. In addition to the endpoint protection provided by SentinelOne products, Progent offers a catalog of managed services and affordably-priced IT support packages created to help small and mid-size businesses to design, deploy, test, and manage networks that feature enterprise-level cybersecurity and low total cost of ownership.

Progent offers expertise in all the endpoints, servers and VMs that can be protected by SentinelOne products. Progent offers services that include Windows 11 migration expertise, Windows 10 integration, Linux integration, Mac OS X and macOS consulting, iPhone and iPad configuration, Android consulting, Windows Server 2022 integration expertise, Windows Server 2019 integration expertise, Hyper-V virtualization support, and VMware vSphere support experts.

For single-click or manual rollback capability, Progent's Windows Server experts can help you to set up Windows Volume Shadow Copy Service (VSS). Progent can also provide online and onsite support from certified Cisco CCIE experts to assist you to design, protect or troubleshoot your network infrastructure. If your network relies on cloud resources, Progent offers the support of Microsoft Azure consultants, Amazon AWS consultants, and Google Cloud integration experts.

Contact Progent about SentinelOne Sales and Configuration Services
To learn more about how Progent can assist you to purchase or integrate SentinelOne products, call 1-800-993-9400 or visit Contact Progent.