Detection is not a screen for your assistant to keep half an eye on. What it actually is: software following what a program is up to, a layer reading that against everything else in motion around you, and somebody whose whole job is choosing the next step while you sleep. All three come attached to every line here.
Matching known signatures stopped being enough a long time ago, and the people still selling it as a headline feature know that perfectly well. What SentinelOne does instead is read conduct: which program launched which other program, what got opened, what it tried to talk to, and whether that pattern resembles somebody collecting, encrypting, or feeling their way sideways through a network. All of that carries on being decided with no connection whatsoever, which describes your laptop somewhere over the Atlantic and the machine in the guest house that nobody has opened since spring.
Fluency is the part that stops each of those judgements arriving alone. It sets machine activity beside sign in attempts, mail records, network traffic, and logs from tools you were already paying for. By the time a human looks at it, the thing has a shape. All the distance between a notification and actual help sits inside that shape.
The first line works the case and tells you what it found. The extended line pulls further sources into one picture, so a sign in from a city nobody has visited and an odd process running on a laptop elsewhere stop being two unrelated shrugs on two unrelated screens. The response tier acts by itself, which is the one you want when the trouble starts at two on a Sunday and the alternative is waking a manager.
Two of these six lines are for Kubernetes nodes and most households will never buy either. They exist because a famous name usually has companies attached to it, and some of those companies run infrastructure of their own. If that is you, count nodes rather than pods, and your platform engineer already knows the number.
The rates underneath arrive from billing as this page opens. Anything you set is held in the running order meanwhile.
Conduct based detection on a laptop, a desktop, or a studio workstation, with a staffed desk reading whatever it produces. Cases reach you already worked, carrying a recommendation instead of a chart for somebody in your office to squint at.
| Made by | SentinelOne, read together with Fluency |
|---|---|
| Runs where | Machines on Windows, macOS, or Linux |
| On a hit | A person tells you, and stays with it until it is clear |
| With no signal | Judgements carry on happening locally |
| Worked by | Fortify 24x7 engineers, whatever the clock says |
| Counted | One per protected endpoint |
All of the first line, with logins, mail, and network activity read alongside the machine rather than in three consoles nobody has time to open.
| Made by | SentinelOne, with Fluency opened out |
|---|---|
| Draws on | Machines, accounts, mail, network traffic |
| On a hit | A person tells you, and stays with it until it is clear |
| History | Held longer, so old activity can be gone back over |
| Fits | A household already living inside Microsoft or Google |
| Counted | One per protected endpoint |
The correlated tier, with hands attached. Push far enough over the line and the machine is pulled off the network, then restored to its earlier state, with an analyst still reading.
| Made by | SentinelOne, acting on its own |
|---|---|
| Containment | The machine is taken off the network |
| Reversal | Whatever a convicted program altered gets put back, where possible |
| Oversight | Each automatic action is reviewed afterwards by a person |
| Fits | Edit bays, finance machines, anything holding unreleased work |
| Counted | One per protected endpoint |
Detection for containerised workloads, counted by node so that the invoice agrees with the figure your platform engineer already has written down somewhere.
| Made by | SentinelOne, in its Kubernetes form |
|---|---|
| Scope | How the workloads on that node behave while running |
| On a hit | A person tells you, and stays with it until it is clear |
| Worked by | Fortify 24x7 engineers, whatever the clock says |
| Counted | One per node |
The node line with correlation running, so what a cluster does is read next to accounts and machines rather than alone on its own island.
| Made by | SentinelOne on Kubernetes, read with Fluency |
|---|---|
| Draws on | Node activity, accounts, machines, and network |
| On a hit | A person tells you, and stays with it until it is clear |
| History | Held longer, so old activity can be gone back over |
| Counted | One per node |
The node line with permission to act, for a cluster where a misbehaving workload cannot simply wait until Monday.
| Made by | SentinelOne on Kubernetes, acting on its own |
|---|---|
| Containment | Automatic action against whichever workload is at fault |
| Oversight | Each automatic action is reviewed afterwards by a person |
| Fits | A production cluster carrying real customer traffic |
| Counted | One per node |
Detection makes a decent control and a dreadful promise. Underneath sits the list of what these six cannot reach. Use it to work out what else belongs around you.
Heads up: card statements show FORTIFY 24X7 - Celebrity Bytes is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.