Network Help for Small and Mid-size Businesses

SentinelOne's Singularity product family is a subscription-based, cloud-centric cyberthreat defense stack that features computer learning algorithms and professional services to deliver enterprise-class endpoint detection and response (Singularity Control and Complete) and managed detection and response (Singularity Complete with Vigilance MDR). SentinelOne's low-profile software agents can be installed in a few minutes to protect endpoints against increasingly sophisticated cyberthreats including ransomware, known and zero-day malware, trojans, hacking tools, memory exploits, script misuse, invasive macros, and living-off-the-land (LotL) abuse. Singularity agents are available for Windows, Apple macOS, Linux distributions, and Kubernetes powered endpoints. Supported deployment models include physical, virtual, VDI desktops, hybrid data centers, and cloud providers. Because SentinelOne software agents are autonomous, they are able to deliver cutting-edge behavior-based protection in real time even during periods when endpoints are unattached to the cloud.

Progent is a certified SentinelOne Partner and dealer and oversees thousands of endpoints protected by SentinelOne technology. SentinelOne Singularity is always the initial EDR response tool deployed by Progent to provide control and visibility of a client's network at the outset of a ransomware recovery. SentinelOne Singularity is in addition the root EDR software powering Progent's Active Security Monitoring managed services. SentinelOne was ranked as a leading visionary in Gartner's 2022 Magic Quadrant for Endpoint Protection Platforms and attained the highest number of analytic detections in real-time with zero delays during the gold-standard MITRE ATT&CK Phase 4 Evaluation. According to Gartner's assessment, "This reaffirms its (SentinelOne's) ability to detect all attacks and provide full details of the techniques and tactics used." SentinelOne also outscored all competition for every use scenario in Gartner's assessment of Critical Capabilities for Endpoint Protection Platforms (EPPs).

Singularity Packages for SentinelOne Endpoint Security
SentinelOne's Singularity product line has several tiers of endpoint security product bundles delivered as a global SaaS solution that delivers high availability, hierarchical policy management by site and group, AI powered malware intelligence, rapid recovery, and a data-driven dashboard for cyberthreat analytics. Packages consist of Control for advanced management, Complete for smart root cause analysis, and Complete with Vigilance MDR for 24/7 advanced monitoring and response. The product tiers are additive. Control and Complete each include all the features and options of the tier below it. Pricing starts at $10 for each endpoint per month for small clients with appropriate discounts for larger deployments. Progent has no minimum endpoint requirement.

The SentinelOne Control Package
The SentinelOne Control Package is the base software and is 100% maintained by the client. For some examples: Endpoint agents need to be updated in the SentinelOne portal, allow rules need to be set, exclusions need to be made, blacklists should be created, threats must be responded to, and many other day-to-day activities that someone in your organization needs to manage and maintain. SentinelOne is just like any other security product in that it has frequent updates to keep its defenses current. Progent can assist with or directly handle these items, but there is additional time and materials billing for all services performed.

With the Control Package you manage your own portal and while Progent and SentinelOne personnel are monitoring and or receiving alerts of serious threats in your environment, we have no authorization to do any work in your environment and will only do best efforts to alert you in case of a serious threat.

Features of the SentinelOne Control Package include:

• Endpoint Prevention (EPP) to block a wide variety of malware, Trojans, hacking tools, and ransomware before they get a foothold
• ActiveEDR Basic for Endpoint Detection and Response (EDR) operates in real-time with or without cloud access. ActiveEDR detects highly sophisticated malware, script misuse and other fileless attacks as they attempt to do compromise your network.
• ActiveEDR Recovery gets users up and running quickly and includes 100% remediation as well as rollback for all supported releases of Microsoft Windows.
• Endpoint Control for Policy-based control of all USB and Bluetooth devices (Win, Mac)
• Firewall Control for Policy-based control of network connectivity to and from assets, including location awareness (Win, Mac, Linux)
• Security Vulnerability Management, along with Application Inventory, for insight into 3rd party apps that have known security gaps mapped to the MITRE Common Vulnerabilities and Exposures (CVE) security database
• Secure Remote Shell capability for direct endpoint connection by event responders and forensics team
• Autonomous SentinelOne agent Storyline Engine
• Simultaneous Static AI and SentinelOne Cloud Intelligence file-based assault defense
• Behavior-based AI fileless attack detection
• Autonomous Threat, Remediation, and Rollback Response
• Quarantine endpoint from network, Incident Analysis, Agent Anti-tamper, Application inventory
• Rogue endpoint discovery

• Co-Managed solution with Progent being sent alerts and notifications of all threats in your environment. Customers are responsible for reacting to threats in their system and optional support time and material is available from Progent's security experts
• ActiveEDR Advanced provides visibility of all non-threatening data.
• ActiveEDR Advanced provides high-level threat hunting. SentinelOne stands out with the ease-of-use characterized by the active nature of the solution in autonomously reacting to attacks.
• Storyline feature for Automated Forensics and quick root cause analysis (RCA). All OS storylines are automatically contextualized with SentinelOne’s patented TrueContext function, simplifying analysts' complex task of event correlation so they can determine the root cause with reduced MTTR.
• Storyline Active Response mitigates zero-day threats with customized detection and hunting rules.
• Deep visibility Storyline Pivot and Hunt by MITRE ATT&CK technique
• EDR Hunting Data retention from 14 days standard to one year optional
• Timelines, file fetch, file integrity monitoring, sandbox integrations
• Other response options are offered and customized to your needs. Includes 1 hour of training in key features and day-to-day management of the SentinelOne portal. During this time, Progent will train in the creation of Exclusions, Blocklists, Mitigation, Agent Updates, Notifications, Client Reports, Application Features, Activity Logs and UI configuration Alerts.

Complete with Vigilance Respond MDR Services
Vigilance Respond and Vigilance Respond Pro are add-on Managed Detection and Response (MDR) programs for subscribers to SentinelOne's Singularity Complete package. These bundles include digital forensics and full 24x7 incident response provided by Tier-1, Tier-2, and Tier-3 cybersecurity experts. Vigilance Respond subscriptions include confirmation of cyberthreats, event prioritization and triage, false positive management and dashboard cleanup, threat containment, thorough reporting, service level agreements, and escalation to the client's cybersecurity team.

Vigilance MDR analysts classify threat notifications according to a hierarchy going from Benign False Positive to Urgent True Positive. This classification determines how the Vigilance analyst handles the detected threat. There are five classes of threats and consequent responses. The majority of alerts do not require a response by the client.

Benign Alert - False Positive
Vigilance resolves the issue and annotates the SentinelOne console. For single False Positive alerts, no additional actions or alerts are required. For persistent False Positive alerts, Vigilance will escalate the issue to the client to offer or agree to a proper exclusion or agent upgrade as needed.

Malicious Alert - True Positive Non-Urgent, Potentially unwanted Program (PuP)
Vigilance takes action to make sure the threat is blacklisted, resolved, and documented. Usually, no alert will be transmitted to the customer unless the issue calls for follow up activity.

Malicious Alert - True Positive / No Action Necessary
Vigilance performs proper actions including remediation to make sure the threat is quarantined. After the SentinelOne analyst confirms the threat is eliminated, the analyst will send a confirmation alert to the client.

Malicious Alert - True Positive Non-Urgent / Action Necessary
Vigilance takes appropriate actions including remediation to make sure the threat is quarantined. Once the analyst verifies the threat is eliminated, the analyst will send a verification alert to the customer. Subsequent activity like re-imaging may be required in some circumstances.

Malicious Alert - True Positive Urgent / Action Necessary
Vigilance may respond aggressively in high priority breach incidents including taking agent remediation actions and isolating compromised network endpoints to stall the attack and prevent additional lateral progress. The analyst will send an urgent notification informing the customer of the situation and ask for immediate response.

In addition to providing all the features of SentinelOne Control and SentinelOne Complete, SentinelOne Complete with Vigilance MDR adds round-the-clock Monitoring with Immediate Threat Response, Remote Script Orchestration, and Ranger:

• Co-Managed Environment with Progent receiving alerts and notifications of all threats and activities in your system and combined SOC response, providing 3 levels of 24x7x365 Detection and Response. Threats are mitigated and responded to in close to real-time. Additional remediation alternatives after threat mitigation are available and tailored to meet your individual needs.
• Remote Script Orchestration enables enterprises to send scripts to one machine, several machines, or even millions of machines, to react to current and future cyberattacks instantly. Security Teams can dispatch customized scripts or choose from a broad selection of jobs – ranging from incident response to forensics artifact collection and even IT administration. In combination with SentinelOne Storyline Active Response, analysts benefit from automated workflows that promote incident response to the next level.
• Ranger provides unmatched visibility into your system. Ranger is network-efficient by intelligently electing a few SentinelOne agents per subnet to undertake network mapping activity. Elected "Rangers" passively listen for network broadcast data such as ARP, DHCP, and other network observances. Administrators can customize active scan policies and specify multiple IP Protocols for learning including ICMP, SNMP, UDP, TCP, SMB, and others. Rangers correlate all collected information within the backend to fingerprint familiar and unfamiliar devices. Ranger device inventories reveal what is connected to your environment, where they are attached, and which protocols the devices listen on. Ranger allows you to expose and close SentinelOne Agent deployment oversights using Ranger Deploy, a peer-to-peer deployment (Windows, Mac, Linux). Ranger enables you to monitor how unknown devices communicate with managed hosts and quarantine suspect devices from managed devices with a click.

Download Progent's SentinelOne Singularity Packages Datasheets
Download datasheets describing Progent's SentinelOne Singularity products and services:

• Overview of Progent's SentinelOne Singularity Packages (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Control Package (PDF - 210 KB)
  

• Progent's SentinelOne Singularity Complete Package (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Complete with MDR Package (PDF - 223 KB)
  

The Progent Advantage
Progent's roster of more than 150 consultants includes certified experts in every facet of network technology related to small and mid-size organizations. With this breadth of expertise, Progent can be your one-stop source for building and managing a cohesive security environment that delivers significant business value. In addition to the endpoint protection available from SentinelOne products and services, Progent offers a variety of managed services and specially-priced IT support packages designed to assist SMBs to design, implement, test, and manage networks that feature enterprise-level cybersecurity and low TCO.

Progent has in-depth experience with all the endpoint devices, servers and virtual machines that can be protected by SentinelOne technologies and services. Progent can provide services that include Windows 11 migration consulting, Windows 10 management, Linux support, Mac OS X and macOS consulting, iPhone and iPad configuration, Android support, Windows Server 2022 integration consulting, Windows Server 2019 migration expertise, Hyper-V virtualization support, and VMware vSphere configuration consulting.

For fast rollback, Progent's Windows Server experts can assist you to configure Windows Volume Shadow Copy Service (VSS). Progent can also provide remote and onsite access to certified Cisco CCIE consultants to help you to design, protect or optimize your infrastructure. If your network relies on cloud resources, Progent can provide the guidance of Microsoft Azure consultants, Amazon AWS experts, and Google Cloud integration experts.

Contact Progent about SentinelOne Sales and Integration Services
To find out more about how Progent can assist you to purchase or configure SentinelOne products, call 1-800-993-9400 or see Contact Progent.