Computer Security and Compliance

SentinelOne's Singularity product line is a subscription-based, cloud-centric cyberthreat defense stack that features computer learning software and professional services to deliver enterprise-class endpoint detection and response (Singularity EDR) and managed detection and response (Singularity Complete with Vigilance MDR). SentinelOne's small-footprint agents can be loaded in a few minutes to defend popular endpoints against increasingly sophisticated assaults including ransomware, familiar and zero-day malware, trojan viruses, hacking toolkits, RAM exploits, malicious scripts, harmful macros, and living-off-the-land attacks. Singularity agents are offered for Microsoft Windows, Apple macOS, Linux distributions, and Kubernetes powered endpoints. Supported deployment models include physical, virtual, VDI desktops, hybrid data centers, and cloud service providers. Since SentinelOne software agents operate autonomously, they can provide advanced behavior-based security in real time even when endpoints are unattached to the cloud.

Progent is a certified SentinelOne Partner and dealer and oversees thousands of endpoints secured by SentinelOne Singularity technology. SentinelOne is invariably the first incident response software activated by Progent to provide control and visibility of a customer's network at the outset of a ransomware recovery emergency. SentinelOne is also the root EDR software powering Progent's Active Security Monitoring (ASM) managed services. SentinelOne was recognized as a top visionary in Gartner's 2022 Magic Quadrant for Endpoint Protection Platforms and attained the highest number of high-quality detections in real-time during the 2022 MITRE ATT&CK Phase 4 Evaluation. Gartner concludes, "This reaffirms its (SentinelOne's) ability to detect all attacks and provide full details of the techniques and tactics used." SentinelOne also surpassed all competition for each use case in Gartner's evaluation of Critical Capabilities for Endpoint Protection Platforms (EPPs).

Singularity Packages for SentinelOne Endpoint Detection and Response
SentinelOne's Singularity family has several tiers of endpoint protection product packages provided as a global cloud-based platform that features high availability, centralized policy management by site and group, AI powered malware intelligence, fast recovery, and an information-driven console for cyberthreat analytics. Packages include Singularity Control for streamlined management, Singularity Complete for advanced protection plus automated root cause analysis, and Singularity Complete with Vigilance MDR for 24/7 advanced monitoring and response. The tiers are incremental. Singularity Complete and Singularity Complete with Vigilance MDR each include all the features and options of the level below it. Subscription rates start at $10 per endpoint per month with appropriate discounts for larger deployments. Progent has no minimum device requirement.

The SentinelOne Control Package
The SentinelOne Control Package is the base software and is 100% maintained by the client. For some examples: Endpoint agents need to be updated in the SentinelOne portal, allow rules need to be set, exclusions need to be made, blacklists should be created, threats must be responded to, and many other day-to-day activities that someone in your organization needs to manage and maintain. SentinelOne is just like any other security product in that it has frequent updates to keep its defenses current. Progent can assist with or directly handle these items, but there is additional time and materials billing for all services performed.

With the Control Package you manage your own portal and while Progent and SentinelOne personnel are monitoring and or receiving alerts of serious threats in your environment, we have no authorization to do any work in your environment and will only do best efforts to alert you in case of a serious threat.

Features of the SentinelOne Control Package include:

• Endpoint Prevention (EPP) to stop a wide range of malware, Trojans, hacking tools, and ransomware before they start
• ActiveEDR Basic for Endpoint Detection & Response (EDR) works in real-time with or without cloud connectivity. ActiveEDR detects highly sophisticated malware, memory exploits, script misuse and other fileless attacks as they attempt to do damage.
• ActiveEDR Recovery gets users up and running in minutes and includes 100% remediation as well as rollback for all supported non-legacy releases of Microsoft Windows.
• Device Control for Policy-based control of all USB devices and Bluetooth peripherals (Win, Mac)
• Firewall Control for Policy-based control of network connectivity to and from assets, including location awareness (Win, Mac, Linux)
• Vulnerability Management, in addition to Application Inventory, for insight into 3rd party apps that have known vulnerabilities mapped to the MITRE CVE database
• Full Secure Remote Shell capability for direct endpoint access by incident responders and forensics personnel
• Autonomous SentinelOne agent Storyline Engine
• Integrated Static AI and SentinelOne Cloud Intelligence file-based attack prevention
• Behavioral AI fileless attack detection
• Autonomous Threat, Remediation, and Rollback Response
• Quarantine device from network, Incident Analysis, Agent Anti-tamper, App inventory
• Rogue device discovery

• Co-Managed environment with Progent receiving alerts and notifications of all threats and activities in your environment. Client is responsible for resolving threats in their environment and optional support time and material is available
• ActiveEDR Advanced adds visibility of all benign data.
• ActiveEDR Advanced adds enterprise threat hunting. SentinelOne differentiates with ease-of-use personified by the active nature of the solution in autonomously responding to attacks.
• Storyline technology for Automated Forensics and fast root cause analysis (RCA). All OS stories are automatically contextualized with SentinelOne’s patented TrueContext function, saving analysts tedious event correlation tasks and getting them to the root cause with reduced MTTR.
• Storyline Active Response (STAR) mitigates zero-day threats with custom detection and hunting rules.
• Deep visibility Storyline Pivot and Hunt by MITRE ATT&CK technique
• EDR Hunting Data retention options from 14 days standard to 365 days optional
• Timelines, file fetch, file integrity monitoring, sandbox integrations
• Additional response options are available and customized to your needs. Includes 1 hour of training in advanced features and day to day management of the SentinelOne portal. During this time, we will train in the creation of Exclusions, Blocklists, Mitigation, Agent Updates, Notifications, Client Reports, Application Features, Activity Logs and UI configuration Alerts.

SentinelOne Complete with Vigilance MDR Managed Detection and Response Services
Vigilance Respond is an add-on MDR program for subscribers to the Singularity Complete bundle. Complete with Vigilance MDR includes digital forensics and full 24x7 incident response provided by Tier-1, Tier-2, and Tier-3 IT security experts. SentinelOne Complete with MDR services include confirmation of threats, event prioritization and triage, false positive handling and dashboard updating, accelerated threat resolution, management reporting, SLAs, and escalation back to the client's cybersecurity team.

Vigilance MDR consultants classify detected threat notifications according to a threat-handling hierarchy ranging from Benign False Positive to Malicious Urgent. This classification determines how the Vigilance analyst responds to the detected threat. There are five categories of threats and corresponding responses. Most alerts require no response by the customer.

Benign Alert - False Positive
Vigilance resolves the issue and annotates the SentinelOne dashboard. For isolated False Positive alerts, no additional actions or notifications are necessary. For persistent False Positive alerts, Vigilance will escalate the issue to the client to submit or approve an appropriate exclusion or agent update as needed.

Malicious Alert - True Positive Non-Urgent, Potentially unwanted Program (PuP)
Vigilance takes action to make sure the threat is blacklisted, resolved, and documented. Typically, no notification will be sent to the customer unless the threat requires additional activity.

Malicious Alert - True Positive / No Action Needed
Vigilance performs appropriate actions including remediation to ensure the threat is quarantined. Once the analyst verifies the threat is eliminated, the analyst will send a verification notice to the customer.

Malicious Alert - True Positive Non-Urgent / Action Needed
Vigilance performs proper actions including remediation to ensure the threat is isolated. After the analyst confirms the threat is deleted, the analyst will send a verification alert to the client. Subsequent procedures such as re-imaging may be called for in some cases.

Malicious Alert - True Positive Urgent / Action Needed
Vigilance may respond strongly in serious breach cases including taking agent remediation actions and disconnecting affected network devices to stall the attack and prevent additional lateral movement and spread. The analyst will transmit a proactive alert apprising the customer of the issue and will ask for an immediate response.

In addition to providing all the features of SentinelOne Control and SentinelOne Complete, SentinelOne Complete with Vigilance MDR adds 24x7 Monitoring with Near Real Time Threat Response, Remote Script Orchestration, and Ranger:

• Fully Co-Managed Environment with Progent receiving alerts and notifications of all threats and activities in your environment and combined SOC response, providing 3 levels of 24x7x365 Detection and Response. All threats are mitigated and responded to in near real-time. Additional remediation options after threat mitigation are available and customized to your individual needs.
• Remote Script Orchestration empowers enterprises to send scripts to one machine, a few hundred machines, or even millions of machines, to respond to present and future cyberattacks at machine speed. Security Teams can send custom scripts or select from a wide range of tasks – ranging from incident response to forensics artifact collection and even IT administration. In combination with SentinelOne Storyline Active Response (STAR), analysts benefit from automated workflows that take incident response to the next level.
• Ranger provides unparalleled visibility into your environment. Ranger is network-efficient by intelligently electing a few SentinelOne agents per subnet to participate in network mapping missions. Elected "Rangers" passively listen for network broadcast data including ARP, DHCP, and other network observances. Admins can customize active scan policies and specify multiple IP Protocols for learning including ICMP, SNMP, UDP, TCP, SMB, and more. Rangers correlate all learned information within the backend to fingerprint known and unknown devices. Ranger device inventories reveal what is connected to your environment, where and the protocols the devices listen on. Ranger allows you to find and close SentinelOne Agent deployment gaps with Ranger Deploy, a peer-to-peer deployment (Windows, Mac, Linux). Ranger allows you to monitor how unknown devices communicate with managed hosts and isolate suspicious devices from managed devices with a click.

Download Progent's SentinelOne Singularity Packages Datasheets
See datasheets describing Progent's SentinelOne Singularity products and services:

• Overview of Progent's SentinelOne Singularity Packages (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Control Package (PDF - 210 KB)
  

• Progent's SentinelOne Singularity Complete Package (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Complete with MDR Package (PDF - 223 KB)
  

Progent has expertise in all the endpoints, servers and virtual machines that can be protected by SentinelOne products and offers services that include Windows 11 planning and migration consulting, Windows 10 integration, Linux support, Mac OS X and macOS consulting, iPhone and iPad configuration, Android integration, Windows Server 2022 integration expertise, Windows Server 2019 migration consulting, Hyper-V virtualization support, and VMware vSphere consulting. For single-click or manual rollback capability, Progent's Windows Server consultants can help you set up Windows Volume Shadow Copy Service (VSS). Progent can also provide online and onsite access to certified Cisco CCIE consultants to help you plan, protect or troubleshoot your network infrastructure. If your network incorporates cloud resources, Progent offers the guidance of Microsoft Azure consultants, Amazon AWS experts, and Google Cloud integration consultants.

Contact Progent about SentinelOne Sales and Integration Services
To find out more about how Progent can help you purchase or integrate SentinelOne technology, call 1-800-993-9400 or visit Contact Progent.

Ransomware 24x7 Hot Line: Call 800-462-8800
Progent's Ransomware 24x7 Hot Line is intended to help you to complete the time-critical first step in responding to a ransomware attack by putting out the fire. Progent's remote ransomware expert can assist you to identify and isolate breached servers and endpoints and guard undamaged resources from being compromised. If your system has been breached by any strain of ransomware, don't panic. Get immediate help by calling Progent's Ransomware Hot Line at 800-462-8800. For details, see Progent's Ransomware 24x7 Hot Line.