SentinelOne
Monitoring, alert investigation, response under approved policy, threat hunting and incident context handover.
Where the service helps during an attack
The service works with your deployed modules. Its main benefit is investigation and initial response without waiting for your team.
| Area | Level |
|---|---|
| Reconnaissance | context |
| Initial access | additional protection |
| Execution and persistence | additional protection |
| Escalation and lateral movement | additional protection |
| Impact | additional protection |
| Investigation and recovery | primary role |
A vendor-managed service, not an APPSEC SOC
Wayfinder Managed Detection and Response is a SentinelOne service within Wayfinder Threat Detection and Response. Vendor analysts operate it, according to its description, around the clock as an extension of your team.
APPSEC does not operate this service or its own SOC. We help assess whether you need it and at which tier, include it in the proposal and prepare the environment and escalation process.
APPSEC
Service tier selection, licensing, deployment and escalation preparation, and support within the proposal's scope.
Customer
Contacts and escalation, response policy approval, and decisions about recovery, communications and environment changes.
How the service works
During onboarding, the vendor agrees escalation procedures with you. Analysts then investigate alerts, filter false positives and respond according to policy: terminate malicious processes, isolate devices or reverse unauthorised changes.
Your team receives incident context and recommended next steps. For serious incidents, the vendor describes access to incident response and digital forensics specialists (DFIR). Scope varies by service tier.
The vendor says analysts use Purple AI to enrich alerts and Google Threat Intelligence for threat intelligence.
- Coverage depends on tier: endpoints and cloud, with identities and supported third-party integrations at higher tiers.
- Proactive threat hunting according to service tier.
- Related vendor Incident Readiness and Response services.
Who the service suits
Organisations using SentinelOne without analysts available to assess alerts around the clock, typically those with small IT teams or security teams limited to working hours.
- Alerts outside working hours receive no response.
- The team struggles to distinguish real incidents from false positives.
- Investigation and initial response experience is missing.
Adding the service with APPSEC
The vendor also offers Guided Onboarding and Deployment and technical account managers. We describe the division of work between APPSEC and the vendor in the proposal so activities do not overlap and contacts are clear.
Requirements
We assess team capacity and availability, and which alerts currently go unassessed.
Service tier
We compare vendor service tiers and coverage against deployed or planned modules.
Preparation
Platform deployment and policies, contacts, escalation matrix and rules for actions without approval.
Operation
APPSEC support within the proposal's scope. SentinelOne delivers MDR under its own terms.
What to check before buying
- Which tier meets your needs and its exact coverage.
- Modules that must be deployed and licensed to provide the required data.
- Actions analysts may take independently and those requiring your consent.
- Communication channels, language and response times under the vendor's contractual terms.
- Any vendor warranty terms and the scope of forensic analysis.
