Three parts have to be present before observation means anything. A sensor that understands conduct. A layer above it holding several records side by side. And a named person willing to make the call at twenty past four on a Sunday morning. Each line described below has all three of them.
Recognising known names stopped being enough the first time somebody changed one. So the SentinelOne sensor works from conduct: which process arrived, what it opened, whose credentials it borrowed, where it reached, and whether the overall pattern suggests encryption sweeping a share or a folder being emptied in an orderly way. The verdict is reached locally, so a laptop on an aircraft and the spare machine in the storeroom are both still protected.
What the sensors report then goes to Fluency, which sets it against directory sign ins, mail activity, traffic records and logs from tools that are already on your invoice. A case that reaches the desk therefore reaches it whole. That is the difference between being handed a question and being handed an answer.
The first tier convicts and advises. The second widens the frame, so that an odd sign in over here and an odd process over there stop looking like two curiosities and become a single event. The third acts on its own conclusion, which is what justifies it on a weekend when nobody is at a desk.
Container hosts carry their own charge. A node is not a workstation, the sensor sits differently on one, and merging the two would produce an invoice that quietly misstates what is protected. The unit is the node, never the pod.
Figures arrive from billing during page load, which is why a printed number and a charged number match. Whatever you enter sits in the folio while you read on.
Judgement made about conduct instead of about filenames. The sensor watches the way a program conducts itself: what it spawned, which folders it touched, which addresses it spoke to, and whether any of that resembles somebody encrypting a share or emptying a records folder. A conviction becomes a written case that one of our people reads and answers.
| Claimed for | Desktops, laptops and servers that carry business work |
|---|---|
| Reduces | Ransomware and intruders who arrive by hand rather than by malware |
| Term | Renews monthly, taken up front, closes when you say so |
| Filed by | SentinelOne |
| Examined by | Fortify 24x7 people, whatever the clock says |
One sensor sees one machine. Fluency lines several sources up beside each other: directory sign ins, mail activity, traffic records. Two harmless looking oddities in different places become a single sequence with an order to it, and an order is what makes a decision possible.
| Claimed for | Businesses whose accounts run within one of the big two tenants |
|---|---|
| Reduces | Stolen credentials and movement between systems that raises no local alarm |
| Term | Renews monthly, taken up front, closes when you say so |
| Filed by | SentinelOne with Fluency correlation |
| Examined by | Fortify 24x7 people, working from the joined sequence |
Correlation with something at the end of it. Past the conviction threshold that machine leaves the network and its changes are reversed, without anybody being woken to authorise it. This is the tier for the till, the bookkeeping desk and whichever machine keeps the customer list.
| Claimed for | Point of sale, bookkeeping, and whichever desk holds the customer list |
|---|---|
| Reduces | The gap between an intrusion beginning and a human noticing |
| Term | Renews monthly, taken up front, closes when you say so |
| Filed by | SentinelOne with automated response |
| Examined by | Fortify 24x7 people, who go back over every automatic step |
Container hosts get their own line because the sensor sits differently on one and behaves differently once it is there. Charging by node keeps the invoice tied to a number your cluster operator can recite without looking it up.
| Claimed for | Kubernetes nodes hosting your own application or a hosted one |
|---|---|
| Reduces | Tampering inside a cluster that never surfaces on an office machine |
| Term | Renews monthly, taken up front, closes when you say so |
| Filed by | SentinelOne |
| Examined by | Fortify 24x7 people, whatever the clock says |
Cluster activity read beside your directory and traffic records. This is how a borrowed deployment credential gives itself away: nothing about the node looks unusual until you notice which account signed off the change and at what hour.
| Claimed for | Clusters whose access runs through a company directory |
|---|---|
| Reduces | Borrowed deployment credentials and pipeline abuse |
| Term | Renews monthly, taken up front, closes when you say so |
| Filed by | SentinelOne with Fluency correlation |
| Examined by | Fortify 24x7 people, working from the joined sequence |
The node tier that intervenes. A convicted workload is shut away rather than left serving while somebody is telephoned, and the account of what happened is written afterwards. Worth having wherever the cluster is the thing customers are paying for.
| Claimed for | Production clusters your customers reach directly |
|---|---|
| Reduces | How long a compromised workload keeps answering requests |
| Term | Renews monthly, taken up front, closes when you say so |
| Filed by | SentinelOne with automated response |
| Examined by | Fortify 24x7 people, who go back over every automatic step |
Worth reading twice. A claim with no stated boundary is one nobody bothered to examine.