EDR
Endpoint Detection and Response

6-Month Trial

SentinelOne Complete EDR

Ihloom Cybersecurity leverages SentinelOne Complete Endpoint Detection and Response (EDR) platform for its unique malware detection and remediation technology. This solution incorporates the industry’s most innovative endpoint threat detection, providing visibility into the root causes and origins of the threat, reversing the malicious operations and remediating them fully.

what you get

24/7 SOC

Our SOC can address the myriad of alerts and notices your endpoints generate, including suspicious activity, system compromise, malware remediation, and false positive process whitelisting.

Support and Policy Creation

Ensure a secure configuration and compliance with the SentinelOne million-dollar remediation warranty.

Expert deployment support

Get help deploying SentinelOne to your organization. Sophisticated EDR solutions are not straightforward or simple. The Ihloom team will assist with best approaches, policy configurations, and troubleshooting support.

DEEP VISIBILITY across all endpoints

Leverage the power of Deep Visibility across
all endpoints for bug hunting and incident response support.

Computer administration. Business tecnology icon. Vector illustration

ADDITIONAL FEATURES

Identify missing or unprotected systems with as-needed Ranger Reports
Month-to-month billing based on utilization
Device control and managed firewall

SentinelOne ActiveEDR™

SentinelOne ActiveEDR™ is an advanced EDR and threat hunting solution that delivers real-time visibility with contextualized, correlated insights accelerating triaging and root cause analysis. The solution allows for automated threat resolution, dramatically reducing the mean time to remediate (MTTR) the incident. ActiveEDR enables proactive hunting capabilities to uncover stealthy, sophisticated threats lurking in the environment.

Detect high-velocity threats with patented Storyline

ActiveEDR, powered by SentinelOne’s patented Storyline technology, provides analysts with real-time, actionable correlation and context and lets security analysts understand the full story of what happened in their environment. Storyline automatically links all related events and activities together an attack storyline with a unique identifier. This allows security teams to see the full context of what occurred within seconds rather than needing to spend hours, days, or weeks correlating logs and linking events manually. SentinelOne’s behavioral engine tracks all activities on the system, including file/registry changes, service start/stop, inter-process communication, and network activity. It detects techniques and tactics that are indicators of malicious behavior to monitor stealthy behavior and effectively identify fileless attacks, lateral movement, and actively executing rootkits. SentinelOne automatically correlates related activity into unified alerts that provide campaign-level insight. This reduces the amount of manual effort needed, helps with alert fatigue, and significantly lowers the skillset barrier of responding to alerts.

Accelerate investigations with seamlessly integrated MITRE ATT&CK techniques

SentinelOne ActiveEDR maps attacks in real-time to the MITRE ATT&CK framework, providing analysts immediate in-product indicators and attack technique context. SentinelOne correlates multiple MITRE observations to the same Storyline, making searching for MITRE ATT&CK Tactics, Techniques, and Procedures (TTPs) fast and painless across your environment. It’s as easy as entering the MITRE technique ID and using this to perform investigations, enabling the security team to understand complex detections quickly.

Remediate the entire attack with patented 1-click remediation & rollback

SentinelOne enables analysts to take all the required actions needed to respond and remediate the threat with a single click. With one click, the analyst can execute a full suite of remediation actions such as network quarantine or killing a process to remove persistence mechanisms. Rollback functionality automatically restores deleted or corrupted files caused by ransomware activity to their pre-infected state without needing to reimage the machine. SentinelOne one-click remediation simplifies response and dramatically reduces mean time to resolution. SentinelOne also offers full Remote Shell capabilities on all platforms to give your security team a quick way to investigate attacks, collect forensic data, and remediate breaches no matter where the compromised endpoints are located. This eliminates uncertainty and significantly reducing any downtime that results from an attack.

Proactively hunt to uncover advanced adversaries

SentinelOne’s Deep Visibility empowers rapid threat hunting capabilities to conduct a deep investigation and enable hunting at scale. Threat hunters can quickly and easily query and pivot across the captured endpoint telemetry. SentinelOne automatically correlates all related objects (processes, files, threads, events, and more). For instance, say a process modifies another process by injecting code. When you run a query, all interactions between the source process, target process, and parent process are shown clearly in the cross-process details. This lets threat hunters quickly understand the data relationships: the root cause behind a threat with all of its context, relationships, and activities and enable them to understand the full story of what happened on an endpoint and see the complete chain of events.

You can create powerful hunting queries with easy-to-use shortcuts. Leverage a query library of hunts curated by SentinelOne research who continually evaluate new methodologies to uncover new IOCs and TTPs. These insights are the output of hypotheses that are proven across research data and are generic. For example, the use of unmanaged, unsigned Powershell is likely abnormal in most environments; and would commonly require additional investigation. The above example is not malicious in and of itself but fits in a hunting workflow, as they are descriptive of anomalies.

SentinelOne Hunter, a Chrome Extension, helps Security Operations and hunters save time. Hunter lets you quickly scrape data from your browser and opens a query in your SentinelOne Management Console to search for that data across your organization. Hunter captures these indicators from information open in your current browser tab: IP addresses, DNS names, and hashes (MD5, SHA-1, and SHA-256). When the indicators of interest are captured, they are redirected to your SentinelOne Management Console. The Hunter extension does not capture any personal or private data from the browser or the user.

Investigate historical data with extended data retention

The ability to look back into any point in time allows analysts to see if the threat has targeted your organization in the past and view the full stream of information on how that attack occurred, including the entire process tree, timeline, and related activities. SentinelOne provides visibility EDR data retention of 365 days and beyond, for full historical analysis of any attack.

EDR Endpoint Detection and Response