Discovery
An inventory of IP-addressed devices, their types and agent status.
Where the module helps during an attack
Network Discovery does not directly detect attacks. It reduces blind spots and limits movement through unmanaged devices.
| Area | Level |
|---|---|
| Reconnaissance | no direct role |
| Initial access | additional protection |
| Execution and persistence | no direct role |
| Escalation and lateral movement | additional protection |
| Impact | no direct role |
| Investigation and recovery | context |
Visibility into devices without an agent
Singularity Network Discovery, formerly Singularity Ranger, adds network visibility to the platform. It uses deployed SentinelOne agents to identify other IP-addressed devices, including those without agents.
According to the vendor, basic identification of agentless devices (Rogues) is included in Singularity Control and Complete. Network Discovery adds detailed discovery, device classification, per-network policies and unmanaged device isolation.
- Selected agents passively listen to network broadcasts.
- Optional active probing through ICMP, SNMP, TCP, UDP or SMB according to policy.
- Identification and classification of known and unknown devices.
- No additional hardware or network infrastructure changes.
How discovery works in practice
Administrators define which networks to discover and how. Selected agents capture broadcasts and may actively query devices according to policy. The platform combines the data and identifies devices.
For sensitive industrial or healthcare networks, active probing can be disabled in favour of passive listening. Policies are configured per network.
Extending protection
Agent deployment to supported devices, including peer-to-peer deployment from protected endpoints according to the vendor.
Isolation
A suspicious device can be separated from protected endpoints through firewall rules enforced by Windows, macOS and Linux agents.
What the module addresses and where it fits
The module does not replace a CMDB, vulnerability scanner or network segmentation. It complements them by using deployed agents to close protection gaps.
- You do not know exactly how many devices are on your network or which lack protection.
- Some devices remain unmanaged after migration or acquisition.
- Your network includes printers, IoT or operational devices that cannot run an agent.
- You need to restrict communication between unmanaged devices and protected endpoints.
Deployment and operation with APPSEC
Network discovery can affect operations and sensitive devices. We first review network segments, their sensitivity and applicable rules with you.
The pilot delivers a discovered device inventory and proposed actions: deploy an agent, register the asset, isolate it or explicitly accept the risk with a rationale.
APPSEC
Discovery policy design, a pilot on selected networks, finding assessment and agent deployment as agreed.
Vendor
The product, discovery methods, device identification and product escalation under the vendor's terms.
Customer
Approval of networks in scope, isolation decisions, asset inventory and coordination with operational teams.
What to check before buying
- Whether basic agentless device identification is sufficient or full Network Discovery is needed.
- Whether every network segment has agents capable of discovery.
- Restrictions on active probing in sensitive networks.
- How findings enter the asset inventory and who decides on isolation.
- Which discovered devices can actually run an agent and which need other measures.
