Network Help for Small and Mid-size Companies

SentinelOne's Singularity portfolio is a subscription-based, cloud-centered cyberthreat defense stack that features AI software and advanced services to deliver enterprise-class endpoint detection and response (Singularity Control and Complete) and managed detection and response (Singularity Complete with Vigilance MDR). SentinelOne's low-profile software agents can be loaded in minutes to guard popular endpoints against increasingly sophisticated assaults including ransomware, known and zero-day malware, trojan viruses, hacking toolkits, memory exploits, malicious scripts, invasive macros, and living-off-the-land (LotL) abuse. Singularity agents are available for Windows, Apple macOS, Linux, and Kubernetes endpoints. Supported deployment models include physical, virtual, VDI desktops, customer and hybrid data centers, and cloud service providers. Because SentinelOne software agents are autonomous, they are able to deliver advanced behavior-based security in real time even if endpoints are not cloud connected.

Progent is a SentinelOne Partner and dealer and manages thousands of endpoints secured by SentinelOne technology. SentinelOne is invariably the first incident response tool activated by Progent to provide control and visibility of a client's network in the first stages of a ransomware breach. SentinelOne is in addition the root EDR software behind Progent's Active Security Monitoring services. SentinelOne has been ranked as a top visionary in Gartner's 2022 Magic Quadrant for Endpoint Protection Platforms and scored the most high-quality detections in real-time during the 2022 MITRE ATT&CK Phase 4 Evaluation. Gartner concludes, "This reaffirms its (SentinelOne's) ability to detect all attacks and provide full details of the techniques and tactics used." SentinelOne also outscored all competitors for every use scenario in Gartner's evaluation of Critical Capabilities for Endpoint Protection Platforms.

Singularity Bundles for SentinelOne Endpoint Detection and Response
SentinelOne's Singularity family includes several tiers of endpoint protection product packages provided as a worldwide cloud-based solution that delivers high availability, centralized policy management by site and group, AI driven malware intelligence, fast restoration, and a data-driven console for security analytics. Packages consist of Control for enhanced management, Complete for automated root cause analysis, and Complete with Vigilance MDR for 24/7 advanced monitoring and response. The product tiers are incremental. Control and Complete each have all the features of the level beneath it. Subscription rates starts at $10 for each endpoint per month for smaller clients with substantial discounts for bigger deployments. Progent has no minimum device requirement.

The SentinelOne Control Package
The SentinelOne Control Package is the base software and is 100% maintained by the client. For some examples: Endpoint agents need to be updated in the SentinelOne portal, allow rules need to be set, exclusions need to be made, blacklists should be created, threats must be responded to, and many other day-to-day activities that someone in your organization needs to manage and maintain. SentinelOne is just like any other security product in that it has frequent updates to keep its defenses current. Progent can assist with or directly handle these items, but there is additional time and materials billing for all services performed.

With the Control Package you manage your own portal and while Progent and SentinelOne personnel are monitoring and or receiving alerts of serious threats in your environment, we have no authorization to do any work in your environment and will only do best efforts to alert you in case of a serious threat.

Major Features of the SentinelOne Control Package include:

• Endpoint Prevention (EPP) to block a broad range of malware, Trojans, hacking tools, and ransomware before they can start
• ActiveEDR Basic for Endpoint Detection and Response (EDR) works in real-time with or without cloud access. ActiveEDR identifies the latest malware, memory exploits and other fileless attacks as they attempt to do damage.
• ActiveEDR Recovery gets users back in business quickly and features 100% remediation as well as rollback for all supported versions of Microsoft Windows.
• Endpoint Control for Policy-based control of all USB and Bluetooth peripherals (Windows, Mac)
• Firewall Control for Policy-based control of network connectivity to and from assets, including location awareness (Win, Mac, Linux)
• Vulnerability Management, in addition to Application Inventory, for insight into third party applications that have known vulnerabilities mapped to the MITRE CVE cybersecurity database
• Full Secure Remote Shell support for direct endpoint access by event responders and forensics personnel
• Autonomous SentinelOne agent Storyline Engine
• Combined Static AI and SentinelOne Cloud Intelligence file-based assault defense
• Behavior-based AI fileless attack detection
• Autonomous Threat, Remediation, and Rollback
• Quarantine device from system, Incident Analysis, Agent Anti-tamper, App inventory
• Rogue device discovery

• Co-Managed solution with Progent being sent alerts and notifications of all threats and activities in your system. Clients are responsible for reacting to threats in their system and extra-cost help time and material is offered from Progent's security experts
• ActiveEDR Advanced provides visibility of all non-threatening data.
• ActiveEDR Advanced provides enterprise threat hunting. SentinelOne is differentiated by the the ease-of-use characterized by the active quality of the solution in autonomously responding to attacks.
• Storyline technology for Automated Forensics and fast root cause analysis (RCA). All OS stories are automatically contextualized with SentinelOne’s proprietary TrueContext technology, simplifying analysts' laborious task of event correlation so they can arrive at root causes with reduced MTTR.
• Storyline Active Response (STAR) combats zero-day threats with customized detection and hunting rules.
• Deep visibility Storyline Pivot and Hunt technology by MITRE ATT&CK technique
• EDR Hunting Data storage ranging from 14 days standard to one year optional
• Timelines, file fetch, file integrity monitoring, sandbox integrations
• Other response alternatives are offered and customized to your needs. Includes 1 hour of training in key features and day-to-day management of the SentinelOne portal. During this time, Progent will demonstrate the specification of Exclusions, Blocklists, Mitigation, Agent Updates, Notifications, Client Reports, Application Features, Activity Logs and UI configuration Alerts.

Complete with Vigilance Respond MDR Services
Vigilance Respond and Vigilance Respond Pro are optional Managed Detection and Response services for subscribers to the Singularity Complete package. These subscriptions include digital forensics and full 24x7 incident response provided by Tier-1, Tier-2, and Tier-3 IT security experts. Vigilance Respond subscriptions include confirmation of threats, event prioritization and triage, false positive handling and console cleanup, threat containment, thorough reporting, SLAs, and escalation to the client's cybersecurity team.

Vigilance MDR analysts rank detected threat alerts based on a threat-handling hierarchy going from Benign False Positive to Urgent True Positive. This ranking determines how the analyst responds to the threat. There are five classes of threats and associated responses. The majority of alerts require no action by the client.

Benign Alert - False Positive
Vigilance takes care of the issue and annotates the SentinelOne console. For isolated False Positive alerts, no other actions or alerts are necessary. For repeated False Positive alerts, Vigilance will escalate the issue to the customer to submit or agree to an appropriate exclusion or agent update as needed.

Malicious Alert - True Positive Non-Urgent, Potentially unwanted Program (PuP)
Vigilance responds to make sure the threat is blacklisted, resolved, and annotated. Usually, no notification will be transmitted to the customer unless the issue requires follow up activity.

Malicious Alert - True Positive / No Action Needed
Vigilance takes proper actions including remediation to ensure the threat is isolated. Once the SentinelOne analyst verifies the threat is deleted, the analyst will send a confirmation alert to the client.

Malicious Alert - True Positive Non-Urgent / Action Needed
Vigilance performs appropriate actions including remediation to ensure the threat is quarantined. After the analyst verifies the threat is deleted, the analyst will send a verification alert to the client. Subsequent procedures like re-imaging may be required in certain circumstances.

Malicious Alert - True Positive Urgent / Action Necessary
Vigilance may respond aggressively in serious breach incidents including pursuing agent remediation actions and disconnecting affected network endpoints to stall the attack and prevent additional lateral progress. The analyst will send a proactive alert apprising the customer of the situation and request immediate response.

In addition to including all the functions of SentinelOne Control and SentinelOne Complete, SentinelOne Complete with Vigilance MDR adds round-the-clock Monitoring with Immediate Threat Response, Remote Script Orchestration, and Ranger:

• Co-Managed Solution with Progent receiving alerts and notifications of all threats and activities in your environment and combined SOC response, providing 3 levels of 24x7x365 Detection and Response. All threats are neutralized and responded to in close to real-time. Further remediation options following threat mitigation are available and customized to meet your individual needs.
• Remote Script Orchestration empowers enterprises to send scripts to one machine, several machines, or even millions of machines, to react to present and future cyberattacks at machine speed. Security Teams can dispatch custom scripts or pick from a broad selection of tasks – ranging from incident response to forensics artifact collection and even IT administration. In combination with SentinelOne Storyline Active Response, analysts can save time with automated workflows that take incident response to a higher level.
• Ranger provides unmatched visibility into your system. Ranger is network-efficient by intelligently designating a small number of SentinelOne agents per subnet to undertake network mapping missions. Elected "Rangers" passively track network broadcast data such as ARP, DHCP, and other network observances. Admins can tailor active scan policies and select multiple IP Protocols for learning including ICMP, SNMP, UDP, TCP, SMB, and more. Rangers correlate all collected information in the backend to characterize familiar and unknown devices. Ranger device inventories reveal what is connected to your system, where they are attached, and what protocols the devices listen on. Ranger enables you to find and close SentinelOne Agent deployment oversights using Ranger Deploy, a peer-to-peer deployment (Windows, Mac, Linux). Ranger allows you to monitor how unknown devices communicate with managed hosts and isolate suspect devices from managed devices with a click.

Download Progent's SentinelOne Singularity Packages Datasheets
See datasheets describing Progent's SentinelOne Singularity products and services:

• Overview of Progent's SentinelOne Singularity Packages (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Control Package (PDF - 210 KB)
  

• Progent's SentinelOne Singularity Complete Package (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Complete with MDR Package (PDF - 223 KB)
  

The Progent Advantage
Progent's roster of over 150 consultants includes experts in every facet of network technology related to small and mid-size businesses. With this scope of expertise, Progent can be your one-stop source for building and managing a comprehensive cybersecurity environment that offers immediate business value. In addition to the endpoint security provided by SentinelOne products, Progent offers a variety of managed services and affordably-priced IT support packages created to assist SMBs to design, deploy, test, and administer networks that feature enterprise-level cybersecurity and low total cost of ownership.

Progent has expertise in all the endpoints, servers and VMs that can be protected by SentinelOne technologies and services. Progent can provide services that include Windows 11 planning and migration consulting, Windows 10 integration, Linux support, Mac support, iPhone and iPad support, Android integration, Windows Server 2022 migration expertise, Windows Server 2019 migration expertise, Hyper-V virtualization support, and VMware vSphere support experts.

For fast rollback capability, Progent's Windows Server consultants can help you to configure Windows Volume Shadow Copy Service (VSS). Progent also offers online and on premises access to certified Cisco CCIE experts to assist you to design, protect or troubleshoot your infrastructure. If your network incorporates cloud resources, Progent offers the support of Microsoft Azure experts, Amazon AWS experts, and Google Cloud integration consultants.

Contact Progent about SentinelOne Sales and Integration Services
To find out more about how Progent can help you to buy or configure SentinelOne products, call 1-800-993-9400 or visit Contact Progent.