Watching is not a screen your office manager glances at between appointments. It is software that grasps what a given process is up to, a layer over it tying that conduct to logins and mail traffic, and a person who chooses what happens next at two on a Sunday morning. Those three arrive together on every entry below.
Checking a file against a catalogue of hashes already known to be hostile lost its value some years back, and the vendors concede as much themselves. What the SentinelOne agent studies instead is conduct: which child processes appeared, which documents were touched, which addresses were contacted, and whether the shape of that resembles bulk encryption, quiet collection, or an account working its way sideways through your shares. Its judgement carries on with the network unplugged, which is what a partner sitting in somebody else's boardroom actually needs.
Fluency assembles those reports into one picture beside directory logins, mail traffic, network flows, and whatever your existing tools already emit. Anything landing on our desk therefore arrives with the surrounding facts attached, and that single property separates a product which informs you from a service which helps.
Of everything sold across this site, watching is the safeguard most often promised inside a policy document and least often running underneath one. A firm can describe log review across two paragraphs while nobody ever opens a log, and measuring that distance is roughly what a written examination finding consists of.
These entries hand you documentation. Every case carries a timestamp, every action taken is spelled out, and the whole thread lives in your portal ready to print. Whether documentation satisfies your particular regulator is not a call available to us. What is fair to say is that firms who walk into that meeting holding none have a considerably longer hour.
The first entry sorts alerts and advises. The second widens what gets tied together, so a login from an unexpected country and an odd process on a machine somewhere else stop being two unrelated curiosities parked in two consoles nobody opens on a Saturday. The third adds automatic isolation and undo, which is the grade you want when trouble begins at six on a Friday evening.
Cluster nodes carry entries of their own. A node resembles a laptop in no useful way, the agent conducts itself differently there, and folding nodes into a machine count would leave the invoice describing something untrue. Count nodes and ignore pods.
Rates below are read live from the billing service. Anything you record sits on your order sheet while you carry on reading the rest of the register.
Conduct based detection on the machine itself, with staffed people behind it. Analysts work the alerts and what arrives on your desk carries a recommendation, not a graph you are expected to decode between client appointments.
| Supplied by | SentinelOne, correlated through Fluency |
|---|---|
| Machines it reaches | Any Windows, macOS, or Linux hardware |
| On conviction | You are told, advised, and helped through the cleanup |
| Away from a network | Judgement continues with nothing connected |
| Who is watching | Our own engineers, at whatever hour the clock shows |
| Charged against | Each protected endpoint, every month |
Everything the first entry provides, broadened so identity, mail, and network activity get read beside the machine instead of living in three consoles that nobody keeps open at the same time.
| Supplied by | SentinelOne, with Fluency correlation broadened |
|---|---|
| Signals joined | Machine, directory, mail, and network |
| On conviction | You are told, advised, and helped through the cleanup |
| Evidence window | Held longer, so an old week can be examined |
| Fits a firm that | Already lives inside a Microsoft or a Google tenant |
| Charged against | Each protected endpoint, every month |
The broadened entry with hands on it. A machine crossing the conviction line is cut off the network and rolled back while an analyst is still reading, which is the whole distance between an incident and an evening.
| Supplied by | SentinelOne, permitted to act unaided |
|---|---|
| Automatic action | Whichever machine tripped it leaves the network |
| Undo | Changes by a convicted process are reversed where possible |
| Checked afterwards by | A person, who records what the software did |
| Fits a firm that | Keeps client files, ledgers, or payment authority on a desk |
| Charged against | Each protected endpoint, every month |
Detection for containerised work, billed by node so the invoice lines up with a figure your platform engineer can already recite without opening anything.
| Supplied by | SentinelOne for Kubernetes |
|---|---|
| What it studies | How workloads behave once they are running on the node |
| On conviction | You are told, advised, and helped through the cleanup |
| Who is watching | Our own engineers, at whatever hour the clock shows |
| Charged against | Each cluster node, every month |
Node detection with correlation switched on, so cluster activity gets read beside directory and machine events instead of sitting on its own in a console somebody opens twice a year.
| Supplied by | SentinelOne for Kubernetes, correlated through Fluency |
|---|---|
| Signals joined | Node runtime, directory, machine, and network |
| On conviction | You are told, advised, and helped through the cleanup |
| Evidence window | Held longer, so an old week can be examined |
| Charged against | Each cluster node, every month |
The node entry with automatic action attached, for a cluster running something nobody can afford to leave misbehaving between Friday evening and Monday.
| Supplied by | SentinelOne for Kubernetes, acting unaided |
|---|---|
| Automatic action | Taken against whichever workload misbehaved |
| Checked afterwards by | A person, who records what the software did |
| Fits a firm that | Puts client facing work onto a production cluster |
| Charged against | Each cluster node, every month |
Two columns, both of them written to be relied on. The right hand column is the one worth reading twice, because a firm that misreads it will believe an obligation is covered when it is still open.
Heads up: card statements show FORTIFY 24X7 - Equity IT Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.
Equity IT Solutions raises no separate charge of its own, so a second line will never turn up beside that one.