SentinelOne Solution

If you are in the market for an Endpoint Detection and Response (EDR) solution and looking to have us manage your EDR, we have partnered with SentinelOne to provide such solution.

The key features include:

• Single, holistic agent for PC, Mac, Linux, VDI
• Multi-layered AI-powered endpoint protection
• Advanced Threat Hunting and device controls
• Policy driven response to threats

The key benefits include:

• Enterprise proven and easily scalable
• Certified and noted as an industry leading solution
• Helps eliminate notification fatigue

This innovative security solution offers broad protection against diverse modes of attack, including:

Malware

• Executables – Trojans, malware, worms, backdoors, payload-based
• Fileless – Memory-only malware, no-disk-based indicators

Exploits

• Documents – Exploits rooted in Office documents, Adobe files, macros, spear phishing emails
• Browser – Drive-by downloads, Flash, Java, Javascript, VBS, IFrame/HTML5, plug-ins

Live/Insider

• Scripts – Powershell, WMI, PowerSploit, VBS
• Credentials – Mimikatz, credentials scraping, tokens

 Sentinel One – Top EDR solution

SentinelOne is recognized as a world leader in EDR software and is recognized by the industry experts.  Here are some of the achieved accolades:

By providing an EDR solution in SentinelOne, it is a solution which is fully integrated with our SIEM solution with AlienVault (see diagram below).

This integration delivers advanced security orchestration between AlienVault’s USM Anywhere and SentinelOne, enabling our clients to quickly take actions on infected endpoints such as isolating a machine, quarantine a file, starting a remote scan, and more.

With pre-built security orchestration and automated response capabilities, you can shorten the time from threat detection to response, without any of the heavy lifting typically required to integrate multiple security IT tools.  These features include but not limited to:

• Shorten the time from threat detection to threat response with automation
• Gain more insights into threats that are detected on your endpoints
• Automate or trigger response actions within USM Anywhere to isolate infected systems
• Save time, money, and headaches by integrating multiple IT security tools

These features, which provide a tight integration of AlienVault and SentinelOne, allows our clients to:

• Enhance threat detection and response capabilities
• Detect threats at the endpoint by utilizing the SentinelOne detection engine that resides on the endpoint agent
• Reduce unwanted “noise” by collecting only threat data from the endpoints.
• Integrated endpoint threat data correlated with AlienVault’s USM Anywhere event data detects behavioral patterns across assets
• Investigate incidents efficiently with rich and contextualized threat data in a single pane of glass