An alert nobody opens is not a control.
Every endpoint product on the market produces detections. The difference between a product and a program is whether a trained person reads them, works out what they mean, and moves while moving still helps. Ransomware crews do not spend days inside a network because the plan called for it. They spend days inside because nobody looked.
This family is the answer to that. The agent supplies the evidence and the automated response. The Fortify 24x7 desk supplies the person, on a Saturday and at three in the morning, which is exactly when it counts.
SentinelOne on the endpoint, Fluency across everything else.
SentinelOne runs its model on the device itself rather than shipping hashes away for an opinion. That matters in two very ordinary situations: when the machine is off the network, and when the threat is new enough that no signature for it exists anywhere on earth. What gets judged is what the process actually did, so ransomware is caught behaving like ransomware.
- Tamper protection. An intruder holding local administrator cannot simply uninstall the agent or stop its service. Removal is gated through the management console, which is ours rather than theirs. Switching off the defense is the opening move in most hands-on intrusions, and this is the control that closes it.
- Independently evaluated. SentinelOne takes part in the MITRE Engenuity ATT&CK Evaluations, where products are run against emulated adversary behavior and the per-technique outcomes are published for anyone to inspect. We would rather point at a test you can read yourself than quote you a number of our own invention.
- Storyline. Related process activity is stitched into a single attack narrative automatically, so an analyst opens one chain of events instead of four hundred unrelated rows. This is a large part of why our response times look the way they do.
- Rollback. On Windows, changes made by a convicted process can be reversed on the machine, which quite often turns an encryption event into an interrupted one.
Fluency is the layer above. Endpoint telemetry is normalized next to mail verdicts, identity events, cloud workload logs, and network data, then correlated. A strange sign-in and an odd process on the same host reach our desk as one case, rather than as two coincidences sitting in two different consoles nobody cross-referenced.
What the desk actually does with it
Detections land in a queue that is worked continuously. An analyst triages, separates benign from suspicious from malicious, and takes whatever action the tier you bought permits: killing processes, quarantining files, and cutting the host off the network while the investigation carries on. You are told what happened and what we did about it.
The plus lines change who performs the remediation. On those, our analysts carry out the remediation of identified events themselves instead of handing you a recommendation and waiting for someone to action it. If your team is small, or is busy being your team, that is the distinction worth paying for.
Kubernetes is priced apart because it is a different thing
Containerized workloads want an agent built for them, and the sensible thing to count is the node rather than the endpoint. The K8 lines carry the SentinelOne Kubernetes agent for precisely that reason. If you do not run Kubernetes, these three lines are not for you, and nobody here will suggest otherwise.
The ladder is the same one you see on the endpoint, rung for rung. MDR-K8 is monitoring and alerting. XDR-K8 is the full detection tier, with the Complete agent and cross-layer correlation. XDR+K8 is the only container line on which our analysts perform the remediation themselves. Pick the rung, then multiply by nodes.
The lines in this family
Six lines / prices fetched liveManaged Detection
per protected endpoint| Agent | SentinelOne, deployed and managed by us |
|---|---|
| Detection | On-device behavioral model, working without cloud connectivity |
| Platforms | Windows / macOS / Linux |
| Desk | SOC monitoring and alerting, 24x7, 365 days |
| Response | Analyst triage; process kill, quarantine, host isolation |
| Correlation | Endpoint telemetry feeding the Fluency analytics layer |
| Counted by | One protected endpoint / monthly |
The entry line. Buy it where you want the endpoint watched and your own people keep the remediation.
Extended Detection
per protected endpoint| Agent | SentinelOne Complete |
|---|---|
| Modules | NGAV, EDR, UEBA, network traffic analysis, cloud workload protection, SIEM |
| Correlated sources | Endpoint / mail / servers / cloud workloads on AWS, Azure and GCP / network / Active Directory |
| Desk | Threat hunting and real-time alerting, 24x7 |
| Response | Automated containment alongside cross-layer analyst triage |
| Counted by | One protected endpoint / monthly |
Extended Detection Plus
per protected endpoint| Agent | SentinelOne Complete |
|---|---|
| Adds over XDR | Direct remediation of identified events by our SOC |
| Correlated sources | Endpoint / mail / servers / cloud workloads / network / Active Directory |
| Desk | Threat hunting, real-time alerting, analyst-performed remediation |
| Counted by | One protected endpoint / monthly |
The line for estates where you would rather we did the work than told you about it.
Managed Detection, Kubernetes
per Kubernetes node| Agent | SentinelOne Kubernetes agent |
|---|---|
| Scope | Containerized workloads and the nodes carrying them |
| Desk | SOC monitoring and alerting, 24x7 |
| Counted by | One Kubernetes node / monthly |
Extended Detection, Kubernetes
per Kubernetes node| Agent | SentinelOne Complete Kubernetes agent |
|---|---|
| Modules | NGAV, EDR, UEBA, network traffic analysis, cloud workload protection, SIEM |
| Correlated sources | Containerized workloads / endpoint / mail / cloud workloads on AWS, Azure and GCP / network / Active Directory |
| Desk | Threat hunting and real-time alerting, 24x7 |
| Response | Automated containment alongside cross-layer analyst triage |
| Counted by | One Kubernetes node / monthly |
The container equivalent of the XDR line: the full detection tier, priced by node. Remediation stays with your team on this rung.
Extended Detection Plus, Kubernetes
per Kubernetes node| Agent | SentinelOne Complete Kubernetes agent |
|---|---|
| Adds over XDR-K8 | Direct remediation of identified events by our SOC |
| Modules | NGAV, EDR, UEBA, network traffic analysis, cloud workload protection, SIEM |
| Desk | Threat hunting, real-time alerting, analyst-performed remediation |
| Counted by | One Kubernetes node / monthly |
One delta separates this from XDR-K8, and it is the same delta that separates XDR+ from XDR on the endpoint: who carries out the remediation. Ask us to size it against your node count rather than buying up by reflex.
What this family does not do
Detection and response is not prevention. It is the layer that assumes something got through and sets out to find it quickly. It does not decide which software may run in the first place, which is Zero trust allowlisting, and it does not filter the message that carried the thing in, which is Email security.
It does not give you your data back. Where files are encrypted before we contain the event, the thing that returns them is a backup, and that sits in Backup and continuity. Rollback on Windows helps frequently. It is not the same promise as a vault.
And it cannot watch an endpoint that has no agent on it. The machine somebody kept off the inventory is the machine we are unable to defend. Tell us about the whole estate, including the awkward corners of it.
Heads up: card statements show FORTIFY 24X7 - CyberDefense is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.