Computer Network Outsourcing for Midsize Businesses

SentinelOne's Singularity product line is a subscription-based, cloud-centric cyberthreat management platform that includes computer learning software and advanced services to provide comprehensive endpoint detection and response (Singularity Control and Complete) and managed detection and response (Singularity Complete with Vigilance MDR). SentinelOne's low-profile agents can be installed in minutes to defend popular endpoints against modern threats including ransomware, familiar and zero-day malware, trojan viruses, hacking tool sets, memory exploits, malicious scripts, destructive macros, and living-off-the-land (LotL) attacks. SentinelOne software agents are offered for Windows, macOS, Linux distributions, and Kubernetes powered endpoints. Compatible deployment models include physical, virtual, VDI desktops, hybrid data centers, and cloud service providers. Because SentinelOne software agents are autonomous, they can deliver cutting-edge behavior-based security in real time even if endpoints are not interfaced to the cloud.

Progent is a SentinelOne Partner and reseller and oversees thousands of endpoints protected by SentinelOne technology. SentinelOne Singularity is invariably the first EDR response software activated by Progent to gain control and visibility of a customer's network in the first stages of a ransomware recovery. SentinelOne Singularity is also the root EDR software powering Progent's Active Security Monitoring (ASM) services. SentinelOne was recognized as a top visionary in Gartner's 2022 Magic Quadrant for Endpoint Protection Platforms and attained the highest number of analytic detections in real-time with zero delays during the 2022 MITRE ATT&CK Phase 4 Evaluation. According to Gartner's assessment, "This reaffirms its (SentinelOne's) ability to detect all attacks and provide full details of the techniques and tactics used." SentinelOne also outscored all competition for each use case in Gartner's assessment of Critical Capabilities for Endpoint Protection Platforms (EPPs).

Singularity Packages for SentinelOne Endpoint Detection and Response
SentinelOne's Singularity product line offers several tiers of endpoint security product packages provided as a worldwide SaaS solution that delivers high availability, centralized policy management by site and group, AI powered malware intelligence, rapid recovery, and an information-driven dashboard for cyberthreat analytics. Bundles include Control for advanced management, Complete for smart forensics, and Complete with Vigilance MDR for 24/7 advanced monitoring and response. The product tiers are incremental. Control and Complete each have all the features of the level below it. Pricing begins at $10 per endpoint per month for smaller clients with substantial discounts for larger accounts. There is no minimum endpoint requirement.

The SentinelOne Control Package
The SentinelOne Control Package is the base software and is 100% maintained by the client. For some examples: Endpoint agents need to be updated in the SentinelOne portal, allow rules need to be set, exclusions need to be made, blacklists should be created, threats must be responded to, and many other day-to-day activities that someone in your organization needs to manage and maintain. SentinelOne is just like any other security product in that it has frequent updates to keep its defenses current. Progent can assist with or directly handle these items, but there is additional time and materials billing for all services performed.

With the Control Package you manage your own portal and while Progent and SentinelOne personnel are monitoring and or receiving alerts of serious threats in your environment, we have no authorization to do any work in your environment and will only do best efforts to alert you in case of a serious threat.

Major Features of the SentinelOne Control Package include:

• Endpoint Prevention (EPP) to stop a broad range of malware, Trojans, hacking tools, and ransomware before they can get a foothold
• ActiveEDR Basic for Endpoint Detection and Response works in real-time even without cloud connectivity. ActiveEDR detects the latest malware, memory exploits and other fileless attacks as they attempt to do damage.
• ActiveEDR Recovery gets users back in business in minutes and includes full repair plus rollback for all non-legacy releases of MS Windows.
• Device Control for Policy-based control of all USB and Bluetooth devices (Win, Mac)
• Firewall Control for Policy-based control of network connectivity to and from assets, including location awareness (Win, Mac, Linux)
• Vulnerability Management, in addition to Application Inventory, for insight into third party apps that have known security gaps mapped to the MITRE Common Vulnerabilities and Exposures (CVE) security dictionary
• Secure Remote Shell support for direct endpoint connection by event responders and forensics personnel
• Autonomous SentinelOne agent Storyline Engine
• Integrated Static AI and SentinelOne Cloud Intelligence file-based assault prevention
• Behavior-based AI fileless incursion detection
• Autonomous Threat, Remediation, and Rollback
• Quarantine device from network, Incident Analysis, Agent Anti-tamper, App inventory
• Rogue device discovery

• Co-Managed solution with Progent being sent alarms and notifications of all threats and activities in your system. Clients are responsible for resolving threats in their environment and optional support time and material is available from Progent's security experts
• ActiveEDR Advanced provides visibility of all benign data.
• ActiveEDR Advanced provides enterprise threat hunting. SentinelOne stands out by the the ease-of-use personified by the active nature of the solution in autonomously reacting to threats.
• Storyline technology for Automated Forensics and fast root cause analysis. All OS storylines are automatically contextualized with SentinelOne’s patented TrueContext function, streamlining analysts' laborious task of event correlation so they can get to the root cause with reduced MTTR.
• Storyline Active Response (STAR) mitigates zero-day attacks with customized detection and hunting rules.
• Deep visibility Storyline Pivot and Hunt by MITRE ATT&CK technique
• EDR Hunting Data storage ranging from 14 days standard to one year optional
• Timelines, file fetch, file integrity monitoring, sandbox integrations
• Other response options are offered and customized to your requirements. Includes an hour of training in advanced features and routine management of the SentinelOne portal. During this time, Progent will train in the specification of Exclusions, Blocklists, Mitigation, Agent Updates, Notifications, Client Reports, Application Features, Activity Logs and UI configuration Alerts.

Complete with Vigilance Respond MDR Services
Vigilance Respond and Vigilance Respond Pro are optional Managed Detection and Response (MDR) services for subscribers to the Singularity Complete package. These packages include full 24x7 incident response provided by Tier-1, Tier-2, and Tier-3 cybersecurity professionals. Vigilance Respond subscriptions include confirmation of cyberthreats, event prioritization, false positive management and console cleanup, threat containment, thorough reporting, service level agreements, and escalation back to the client's cybersecurity organization.

Vigilance MDR consultants classify threat notifications according to a hierarchy going from Benign to Urgent True Positive. This ranking dictates how the Vigilance analyst handles the threat. There are five classes of threats and associated responses. Most alerts require no action by the client.

Benign Alert - False Positive
Vigilance resolves the issue and updates the SentinelOne console. For single False Positive alerts, no other actions or notifications are required. For repeated False Positive alerts, Vigilance will escalate the issue to the customer to submit or approve an appropriate exclusion or agent upgrade as needed.

Malicious Alert - True Positive Non-Urgent, Potentially unwanted Program (PuP)
Vigilance takes action to make sure the threat is blocklisted, resolved, and documented. Usually, no notification will be transmitted to the client unless the issue calls for follow up work.

Malicious Alert - True Positive / No Action Needed
Vigilance performs proper actions including remediation to make sure the threat is isolated. After the analyst confirms the threat is deleted, the analyst will transmit a verification alert to the client.

Malicious Alert - True Positive Non-Urgent / Action Needed
Vigilance takes appropriate actions including remediation to make sure the threat is quarantined. Once the analyst confirms the threat is deleted, the analyst will transmit a confirmation alert to the customer. Follow-up procedures like re-imaging may be necessary in some circumstances.

Malicious Alert - True Positive Urgent / Action Necessary
Vigilance may respond strongly in serious breach cases including taking agent remediation actions and disconnecting compromised network devices to isolate the attack and block additional lateral progress. The analyst will send a proactive notification apprising the customer of the issue and ask for immediate response.

In addition to providing all the functions of SentinelOne Control and SentinelOne Complete, SentinelOne Complete with Vigilance MDR adds round-the-clock Monitoring with Immediate Threat Response, Remote Script Orchestration, and Ranger:

• Fully Co-Managed Environment with Progent seeing warnings and notifications of all threats and activities in your environment and combined SOC response, offering 3 levels of 24x7x365 Detection and Response. Threats are neutralized and responded to in near real-time. Additional remediation options following threat mitigation are available and tailored to your organization's needs.
• Remote Script Orchestration empowers enterprises to send scripts to one machine, several machines, or even millions of machines, to react to present and future cyberattacks at machine speed. Security Teams can dispatch customized scripts or choose from a broad selection of jobs – ranging from incident response to forensics artifact collection and even network administration. In conjunction with SentinelOne Storyline Active Response, analysts benefit from automated workflows that take incident response to the next level.
• Ranger enables unmatched visibility into your system. Ranger is network-efficient by intelligently electing a small number of SentinelOne agents per subnet to undertake network mapping activity. Elected "Rangers" passively track network broadcast data including ARP, DHCP, and other network observances. Admins can modify current scan policies and select multiple IP Protocols for learning including ICMP, SNMP, UDP, TCP, SMB, and others. Rangers correlate all learned information in the backend to fingerprint familiar and unfamiliar devices. Ranger device inventories show what is connected to your system, where they are attached, and what protocols the devices listen on. Ranger enables you to find and close SentinelOne Agent deployment gaps with Ranger Deploy, a peer-to-peer deployment (Windows, Mac, Linux). Ranger permits you to monitor how unfamiliar devices communicate with managed hosts and quarantine suspicious devices from managed devices with a click.

Download Progent's SentinelOne Singularity Packages Datasheets
See datasheets about Progent's SentinelOne Singularity packages:

• Overview of Progent's SentinelOne Singularity Packages (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Control Package (PDF - 210 KB)
  

• Progent's SentinelOne Singularity Complete Package (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Complete with MDR Package (PDF - 223 KB)
  

The Progent Advantage
Progent's team of over 150 consulting professionals includes certified experts in every aspect of information technology associated with small and mid-size organizations. With this scope of expertise, Progent can be your single point of contact for building and managing a comprehensive cybersecurity solution that delivers immediate business value. In addition to the endpoint protection available from SentinelOne products and services, Progent offers a catalog of managed services and affordably-priced support packages created to help SMBs to plan, implement, validate, and manage networks that feature enterprise-level cybersecurity and low TCO.

Progent has in-depth experience with all the endpoint devices, servers and virtual machines that can be protected by SentinelOne technologies and services. Progent offers services that include Windows 11 planning and migration expertise, Windows 10 integration, Linux support, Mac OS X and macOS consulting, iPhone and iPad support, Android support, Windows Server 2022 migration expertise, Windows Server 2019 integration consulting, Hyper-V virtualization consulting, and VMware vSphere integration experts.

For single-click or manual rollback capability, Progent's Windows Server experts can assist you to configure Windows Volume Shadow Copy Service (VSS). Progent can also provide remote and onsite support from certified Cisco CCIE consultants to assist you to plan, defend or debug your infrastructure. If your network incorporates cloud assets, Progent offers the support of Microsoft Azure consultants, Amazon AWS experts, and Google Cloud integration consultants.

Contact Progent about SentinelOne Sales and Configuration Services
To learn more about how Progent can help you to buy or configure SentinelOne products, call 1-800-993-9400 or see Contact Progent.