Computer Network Support for Medium-size Businesses

SentinelOne's Singularity portfolio is a subscription-based, cloud-centric threat management stack that features AI software and professional services to provide enterprise-class endpoint detection and response (Singularity Control and Complete) and managed detection and response (Singularity Complete with Vigilance MDR). SentinelOne's compact software agents can be loaded in a few minutes to protect popular endpoints against increasingly sophisticated assaults such as ransomware, known and new malware, trojans, hacking toolkits, RAM exploits, malicious scripts, invasive macros, and living-off-the-land (LotL) attacks. Singularity software agents are available for Microsoft Windows, macOS, Linux distributions, and Kubernetes powered endpoints. Compatible form factors include physical, virtual, VDI, hybrid data centers, and cloud providers. Because SentinelOne agents are autonomous, they can provide advanced behavior-based protection in real time even if endpoints are not interfaced to the cloud.

Progent is a SentinelOne Partner and reseller and manages thousands of endpoints secured by SentinelOne technology. SentinelOne is invariably the first incident response software activated by Progent to gain control and visibility of a customer's system in the first stages of a ransomware recovery emergency. SentinelOne is in addition the key EDR software behind Progent's Active Security Monitoring services. SentinelOne has been recognized as a leading visionary in Gartner's 2022 Magic Quadrant for Endpoint Protection Platforms and attained the most high-quality detections in real-time with zero delays during the 2022 MITRE ATT&CK Phase 4 Evaluation. According to Gartner's assessment, "This reaffirms its (SentinelOne's) ability to detect all attacks and provide full details of the techniques and tactics used." SentinelOne also surpassed all competitors for every use scenario in Gartner's assessment of Critical Capabilities for Endpoint Protection Platforms (EPPs).

Singularity Bundles for SentinelOne Endpoint Security
SentinelOne's Singularity family has several tiers of endpoint protection product packages delivered as a worldwide SaaS solution that delivers high availability, centralized policy management, AI driven threat intelligence, rapid recovery, and an information-driven dashboard for security analytics. Packages consist of Control for enhanced management, Complete for automated forensics, and Complete with Vigilance MDR for 24/7 advanced monitoring and response. The product tiers are additive. Control and Complete each include all the features of the level below it. Subscription rates begins at $10 for each endpoint per month for small customers with significant discounts for larger accounts. There is no minimum device count.

The SentinelOne Control Package
The SentinelOne Control Package is the base software and is 100% maintained by the client. For some examples: Endpoint agents need to be updated in the SentinelOne portal, allow rules need to be set, exclusions need to be made, blacklists should be created, threats must be responded to, and many other day-to-day activities that someone in your organization needs to manage and maintain. SentinelOne is just like any other security product in that it has frequent updates to keep its defenses current. Progent can assist with or directly handle these items, but there is additional time and materials billing for all services performed.

With the Control Package you manage your own portal and while Progent and SentinelOne personnel are monitoring and or receiving alerts of serious threats in your environment, we have no authorization to do any work in your environment and will only do best efforts to alert you in case of a serious threat.

Major Features of the SentinelOne Control Package include:

• Endpoint Prevention (EPP) to block a wide variety of malware, Trojans, hacking tools, and ransomware before they start
• ActiveEDR Basic for Endpoint Detection and Response (EDR) operates in real-time even without cloud access. ActiveEDR identifies the latest malware, memory exploits and other fileless assaults as they attempt to do damage.
• ActiveEDR Recovery gets users back in business in minutes and includes 100% repair plus rollback for all non-legacy releases of Microsoft Windows.
• Endpoint Control for Policy-based control of all USB and Bluetooth peripherals (Windows, Mac)
• Firewall Control for Policy-based control of network connectivity to and from assets, including location awareness (Win, Mac, Linux)
• Vulnerability Management, in addition to Application Inventory, for insight into third party apps that have known security gaps mapped to the MITRE CVE security dictionary
• Full Secure Remote Shell support for direct endpoint connection by event responders and forensics team
• Autonomous SentinelOne agent Storyline Engine
• Combined Static AI and SentinelOne Cloud Intelligence file-based assault defense
• Behavior-based AI fileless attack detection
• Autonomous Threat, Remediation, and Rollback
• Quarantine endpoint from network, Incident Analysis, Agent Anti-tamper, Application inventory
• Rogue endpoint discovery

• Co-Managed solution with Progent being sent alerts and notices of all threats in your environment. Clients are responsible for reacting to issues in their environment and optional assistance time and material is offered from Progent's security experts
• ActiveEDR Advanced adds visibility of all non-threatening data.
• ActiveEDR Advanced provides enterprise threat hunting. SentinelOne is differentiated with the ease-of-use characterized by the active quality of the solution in autonomously responding to attacks.
• Storyline technology for Automated Forensics and fast root cause analysis. All OS storylines are automatically contextualized with SentinelOne’s proprietary TrueContext function, simplifying analysts' tedious job of event correlation before they can arrive at the root cause with reduced MTTR.
• Storyline Active Response (STAR) mitigates zero-day attacks with customized detection and hunting rules.
• Deep visibility Storyline Pivot and Hunt by MITRE ATT&CK technique
• EDR Hunting Data retention from 14 days standard to one year optional
• Timelines, file fetch, file integrity monitoring, sandbox integrations
• Additional response options are offered and customized to your needs. Includes 1 hour of training in advanced features and day-to-day management of the SentinelOne portal. During this training, Progent will demonstrate the creation of Exclusions, Blocklists, Mitigation, Agent Updates, Notifications, Client Reports, Application Features, Activity Logs and UI configuration Alerts.

Complete with Vigilance Respond Managed Detection and Response (MDR) Services
Vigilance Respond and Vigilance Respond Pro are add-on Managed Detection and Response services for subscribers to the Singularity Complete bundle. These bundles include digital forensics and full 24x7x365 incident response delivered by Tier-1, Tier-2, and Tier-3 cybersecurity experts. Vigilance Respond services include validation of cyberthreats, event prioritization, false positive handling and console cleanup, proactive threat deactivation, thorough reporting, service level agreements, and escalation to the customer's security organization.

Vigilance MDR consultants classify threat alerts according to a hierarchy ranging from Benign to Urgent True Positive. This ranking dictates how the analyst handles the threat. There are five categories of threats and consequent responses. Most alerts do not require a response by the client.

Benign Alert - False Positive
Vigilance takes care of the issue and annotates the SentinelOne console. For isolated False Positive alerts, no additional responses or alerts are needed. For repeated False Positive alerts, Vigilance will escalate the issue to the customer to submit or approve an appropriate exclusion or agent update as needed.

Malicious Alert - True Positive Non-Urgent, Potentially unwanted Program (PuP)
Vigilance responds to ensure the threat is blacklisted, resolved, and documented. Usually, no notification will be transmitted to the client unless the threat calls for additional activity.

Malicious Alert - True Positive / No Action Needed
Vigilance takes appropriate actions including remediation to ensure the threat is quarantined. Once the analyst confirms the threat is deleted, the analyst will send a verification notice to the client.

Malicious Alert - True Positive Non-Urgent / Action Necessary
Vigilance performs proper actions including remediation to make sure the threat is quarantined. After the SentinelOne analyst confirms the threat is deleted, the analyst will send a verification alert to the client. Subsequent procedures like re-imaging may be required in certain cases.

Malicious Alert - True Positive Urgent / Action Needed
Vigilance may react aggressively in serious breach cases including pursuing agent remediation actions and disconnecting affected network endpoints to stall the attack and block additional lateral progress. The analyst will send an urgent alert informing the customer of the issue and request immediate response.

In addition to providing all the functions of SentinelOne Control and SentinelOne Complete, SentinelOne Complete with Vigilance MDR adds round-the-clock Monitoring with Near Real Time Threat Response, Remote Script Orchestration, and Ranger:

• Fully Co-Managed Solution with Progent receiving alerts and notifications of all threats and activities in your system and combined SOC response, offering 3 levels of 24x7x365 Detection and Response. Threats are neutralized and responded to in close to real-time. Extra remediation options after threat mitigation are available and tailored to your individual needs.
• Remote Script Orchestration empowers enterprises to send scripts to a single machine, a few hundred machines, or even millions of machines, to react to present and future cyberattacks instantly. Security Teams can dispatch custom scripts or choose from a broad selection of tasks – ranging from incident response to forensics artifact collection and even network administration. In combination with SentinelOne Storyline Active Response (STAR), analysts benefit from automated workflows that take incident response to the next level.
• Ranger provides unparalleled visibility into your environment. Ranger is network-efficient by intelligently electing a small number of SentinelOne agents per subnet to participate in network mapping missions. Elected "Rangers" passively listen for network broadcast data including ARP, DHCP, and other network observances. Admins can tailor current scan policies and select multiple IP Protocols for machine learning including ICMP, SNMP, UDP, TCP, SMB, and more. Rangers correlate all collected information within the backend to fingerprint familiar and unknown devices. Ranger device inventories show what is attached to your environment, where they are attached, and what protocols the devices listen on. Ranger allows you to expose and close SentinelOne Agent deployment gaps using Ranger Deploy, a peer-to-peer deployment (Windows, Mac, Linux). Ranger enables you to monitor how unfamiliar devices communicate with managed hosts and isolate suspect devices from managed devices with a click.

Download Progent's SentinelOne Singularity Packages Datasheets
Download datasheets about Progent's SentinelOne Singularity products and services:

• Overview of Progent's SentinelOne Singularity Packages (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Control Package (PDF - 210 KB)
  

• Progent's SentinelOne Singularity Complete Package (PDF - 214 KB)
  

• Progent's SentinelOne Singularity Complete with MDR Package (PDF - 223 KB)
  

The Progent Advantage
Progent's team of more than 150 consulting professionals includes experts in every aspect of network technology associated with small and mid-size organizations. With this breadth of knowledge, Progent can be your one-stop source for integrating a comprehensive cybersecurity solution that offers immediate business value. In addition to the endpoint protection available from SentinelOne products and services, Progent offers a variety of managed services and specially-priced IT support packages designed to assist small and mid-size businesses to design, deploy, validate, and manage networks that feature enterprise-level cybersecurity and low total cost of ownership.

Progent has expertise in all the endpoints, servers and virtual machines that can be protected by SentinelOne technologies and services. Progent offers services that include Windows 11 migration consulting, Windows 10 management, Linux integration, Mac consulting, iPhone and iPad integration, Android configuration, Windows Server 2022 integration expertise, Windows Server 2019 integration consulting, Hyper-V virtualization expertise, and VMware vSphere integration consulting.

For single-click or manual rollback capability, Progent's Windows Server experts can help you to set up Windows Volume Shadow Copy Service (VSS). Progent can also provide online and on premises access to certified Cisco CCIE consultants to assist you to plan, defend or troubleshoot your network infrastructure. If your network relies on cloud assets, Progent offers the guidance of Microsoft Azure consultants, Amazon AWS experts, and Google Cloud integration experts.

Contact Progent about SentinelOne Sales and Configuration Services
To learn more about how Progent can help you to buy or integrate SentinelOne endpoint security products, call 1-800-993-9400 or visit Contact Progent.