Detection
The agent recognises suspicious process behaviour and stops or reports it according to policy.
Where the module helps during an attack
Endpoint has its main role where the attack runs on a device: malicious code execution, data encryption and subsequent investigation.
| Area | Level |
|---|---|
| Reconnaissance | context |
| Initial access | additional protection |
| Execution and persistence | primary role |
| Escalation and lateral movement | additional protection |
| Impact | primary role |
| Investigation and recovery | primary role |
Prevention, detection and response in one agent
Singularity Endpoint is the foundation of the SentinelOne platform. An endpoint or server agent combines malicious code prevention (EPP) with suspicious behaviour detection and response (EDR). The vendor provides agents for Windows, macOS and Linux.
Detection goes beyond known signatures. The agent monitors what processes actually do and can respond locally. According to the vendor, it protects devices even without a console connection. Visibility and remote management resume once the connection is restored.
- Prevention and behavioural detection of ransomware, exploits and fileless attacks.
- Network isolation of devices and termination of malicious processes.
- Remediation of changes and rollback to the pre-attack state on supported Windows systems.
- Remote shell for investigation and remediation from the console, subject to licensing and permissions.
- USB and Bluetooth device control on Windows and macOS, and firewall control on Windows, macOS and Linux, depending on licensing and platform.
- Optional RemoteOps Forensics for collecting forensic artefacts and running scripts across many devices, subject to licensing.
How the module works during a real event
When the agent identifies malicious activity, policy determines whether it blocks it automatically or alerts an analyst to decide. We configure the response mode with operational impact and critical applications in mind.
Storyline continuously connects related processes, files and network events into one timeline. Analysts can find the root cause faster without manually piecing together individual records.
Context
Storyline shows preceding activity, related files and connections, and where to investigate next.
Response
Device isolation, process termination, file quarantine and remediation of changes.
Recovery
On supported Windows systems, protected shadow copies can restore changes. Recovery options on macOS and Linux are limited.
A practical first step when replacing antivirus
Endpoint is a natural starting point for organisations replacing traditional antivirus or older EDR and seeking consistent visibility across their devices. It also suits environments with laptops working outside the corporate network.
- Ransomware and malicious scripts that evade signature-based detection.
- Slow investigations that require teams to piece together events from several tools.
- Inconsistent policies across workstations, servers and laptops outside the office.
- Uncontrolled USB device use, when device control is included in the licence.
Deployment and operation with APPSEC
Your team approves policies, exclusions and interventions in production systems. The vendor handles product escalation under its terms. If you lack capacity to assess alerts, consider the vendor's Wayfinder MDR managed service.
Inventory
We review device numbers and types, operating systems, existing protection, critical applications and required exclusions.
Pilot
On a selected group, we verify policies, response mode, compatibility and user impact against agreed criteria.
Migration
We gradually remove existing protection, deploy the agent and configure groups, roles and escalation.
Operation
We hand over documentation to your administrators and provide support within the proposal's scope. Continuous monitoring is not automatically included.
What to check before buying
- Features included in the selected package. The vendor currently groups them into packages such as Singularity Complete, Commercial and Enterprise, and additional modules.
- Supported operating system versions and any legacy systems in your environment.
- Telemetry retention for investigations and export options.
- Who will assess alerts and who may approve actions on devices.
- Console hosting and data location requirements.
Methodological and product sources
- SentinelOne — Singularity Endpoint
- SentinelOne — Singularity Endpoint Protection Platform (Storyline, rollback)
- SentinelOne — Singularity Complete
- SentinelOne — Singularity Control (device and firewall control)
- SentinelOne FAQ (supported systems, rollback, offline protection)
- SentinelOne — ransomware rollback explained
- SentinelOne — Singularity RemoteOps Forensics
