Software that finds something at three in the morning.
Every product in this category will tell you it detects. The question that decides whether detection was worth buying is what happens in the following nine minutes, and that question is answered by staffing, not by software.
Each of these lines places a SentinelOne agent on the machine and puts our security operations centre behind it. The agent watches behaviour rather than waiting to recognise a file it has seen before, which is the only approach that has ever worked against material written specifically for one target. Ransomware, credential theft and the fileless techniques that live entirely in memory all announce themselves by what they do, in a sequence that does not resemble a person working.
What separates the three.
Managed Detection is the endpoint and the desk. The agent prevents and detects on the machine, and our analysts monitor and alert around the clock. For a household where the estate is a set of laptops and a couple of servers, this is a complete and proportionate answer.
Extended Detection widens the evidence. The same agent, at its Complete tier, is joined by telemetry from beyond the endpoint: mail, servers, cloud workloads in the major providers, network activity and directory events. That evidence is correlated in Fluency, the analytics platform our desk works inside, and correlating those layers converts four dull events into a single attributed sequence. A message opened at nine, a credential used from an unfamiliar address at ten, a directory role changed at ten past, and a process on a laptop at half past are one story, and only a system holding all four can say so.
Extended Detection, Full adds our direct remediation. At the lower tiers we detect, investigate and tell you, and act on your instruction. At this tier the desk acts on identified threats on your behalf within the authority you set in writing when you join.
Who is allowed to take a machine off the network.
This is the part worth reading slowly, because for our clients an unnecessary isolation can be as disruptive as an incident. Pulling a laptop off the network at eleven at night is straightforward when it belongs to an accounts clerk and a serious decision when the person holding it is on stage in ninety minutes.
So we agree the authority in advance, in writing, and it can differ by device. Isolate the business machines without asking. Never isolate the principal\'s handset or laptop without a call to a named person first. Whatever the rule is, our analysts hold it and the audit record shows what was done, when, and under whose authority.
Where the K8 lines apply.
The three lines ending in K8 are the same service delivered by a Kubernetes agent, billed per agent, for estates that run containerised workloads. Production companies, media platforms and application ventures reach this point without ever intending to.
If no cluster exists anywhere in your world, ignore all three; nothing else in your protection leans on them. We would sooner write that plainly than let a list imply otherwise.
| Built on | SentinelOne on the machine, with Fluency analytics behind the desk |
|---|---|
| Agent, Managed Detection | SentinelOne agent on the endpoint |
| Agent, Extended tiers | SentinelOne Complete on the endpoint |
| Desk | Security operations centre monitoring and alerting, twenty four hours, all year |
| Evidence, Managed Detection | Endpoint behaviour and process activity |
| Evidence, Extended tiers | Endpoint, mail, servers, cloud workloads in the major providers, network and directory |
| Analytics, Extended tiers | Next generation antivirus, endpoint detection, user and entity behaviour, cloud workload protection, traffic analysis on the network, and security information management |
| Hunting | Analysts hunting for threats, and alerting in real time |
| Response, Managed and Extended | Investigation and alerting, with action on your instruction |
| Response, Extended Full | Direct remediation of identified threats by the desk, within the authority you set |
| Authority | Agreed in writing at onboarding and recorded per device |
| Billed | Monthly, for each computer |
| Built on | The SentinelOne Kubernetes agent, with Fluency analytics behind the desk |
|---|---|
| Deployment | Kubernetes agent, for containerised workloads |
| Tiers | The three tiers above, delivered to the cluster |
| Desk | The same security operations centre and the same authority model |
| Billed | Monthly, for each Kubernetes agent |
Where this family stops
Detection assumes the agent is installed and reporting, which is what management is for. It watches the machine, not the phone in your pocket, which is Phone Protection.
Retention windows, the exact telemetry sources connected for your estate, and the response authority per device are confirmed with you in writing during onboarding rather than asserted on this page. Estates differ, and a number printed here would be a guess.