A Fortify 24x7 brand. Pilotage across the security stack, and your own people stay on the helm.Chart roomSpeak to a duty engineer
Independence IT Group
Chart 03 / Detection and watchkeeping

A quiet estate and an unwatched estate look identical from the bridge.

Watchkeeping is not a screen somebody is supposed to glance at. Three things have to hold at once: a sensor grasping what any given process is doing, a layer joining that to whatever else moves across the company, and a named human whose job is deciding, at 4am, whether tonight is the night. Every code drawn on this chart carries all three.

SentinelOneFluencyWatch kept around the clock
6 lines drawn here / every rate live from billing
Lines on this chart6
PlatformsSentinelOne + Fluency
Billed onEndpoint or cluster node
WatchKept continuously

What the sensor is really reading

Checking files off a roster of known bad ones stopped sufficing years ago. What runs on the machine now is a model of conduct: which parent started which child, what got opened and in which order, which addresses got reached for, plus whether the overall shape suggests encryption under way, collection in progress, or a quiet stroll across a network. That reasoning needs no link home at all, which is why a laptop out over the Atlantic and a build host abandoned in a lab are both still defended.

Correlation is the second half. Fluency sets agent reports beside authentication records, mail records, network telemetry, and logs from tooling your company already pays for. Whatever lands on our desk therefore comes with its context attached, and context is the whole gap between a company being notified and a company being helped.

Being notified at 4am and being helped at 4am are different products.

Picking the right response grade

Grade one triages and advises. Grade two widens the field of correlation, so that an unexpected sign in from Lisbon and an odd binary running on a laptop in Toronto stop being filed as two unrelated oddities. Grade three puts hands on the wheel: isolation and rollback happen without waiting for anybody, which is what earns its keep when the trouble starts on a holiday weekend.

Cluster nodes carry separate line codes. The agent behaves differently there, nodes resemble laptops not at all, and quietly adding them to an endpoint count would print a figure on your invoice describing nothing real. The quantity to count is nodes. Pods do not enter into it.

Codes drawn on this chart

Line sheets and rates

Figures underneath arrive directly out of billing. Whatever gets logged waits in the logbook while you keep reading.

Fortify-MDRLine sheet

Managed Detection and Response

SentinelOne aboard the hardware, tied together by Fluency, worked by analysts

Conduct based detection at the endpoint, with a staffed watch standing behind it. People do the work, which is why what returns already has a recommendation on it instead of a graph awaiting your interpretation.

  • One agent covers Windows, covers macOS, covers Linux, and keeps reasoning with the link down.
  • Triage, investigation, and escalation are worked end to end at our Fortify 24x7 watch desk.
  • Case history and what was concluded stay readable in your chart room, at any hour.
Piloted onSentinelOne, correlated by Fluency
SoundsProcess conduct across Windows, macOS, and Linux
Logged forInvestigation history, kept readable in the chart room
Handed toFortify 24x7 watch, any hour of the day
Charted byProtected endpoint, monthly
Soundingper protected endpoint
taken each month, always up frontQTY
Fortify-XDRLine sheet

Extended Detection Across Layers

SentinelOne, given a wider field of view through Fluency

Grade one, with the field of view opened out. Identity, mail, and network signal get read in the same frame as the endpoint instead of living in windows that nobody has time to open side by side.

  • Endpoint telemetry read alongside sign in records, mail, and network flow.
  • Findings a solitary agent could never reach on its own evidence alone.
  • Retention stretched further, since plenty of cases only resolve in hindsight.
Piloted onSentinelOne, with Fluency correlation widened
SoundsEndpoint, identity, mail, and network read in one frame
Logged forLonger retention, so a case can be worked in hindsight
Handed toFortify 24x7 watch, any hour of the day
Charted byProtected endpoint, monthly
Soundingper protected endpoint
taken each month, always up frontQTY
Fortify-XDR+Line sheet

Extended Detection with Response

SentinelOne, with isolation and rollback left running unattended

Grade two, given hands. Once conviction crosses the threshold, the machine gets cut away from the network and reverted to its prior state, while an analyst is still opening the file.

  • Endpoints come off the network by themselves once conviction is firm enough.
  • Whatever a convicted process rewrote goes back, wherever the platform allows it.
  • No automated action goes unexamined: a person reviews it later and writes it up.
Piloted onSentinelOne, running automated response
SoundsProcess conduct, plus the correlated company around it
Logged forEvery automated action, examined afterward and written up
Handed toFortify 24x7 engineers, arriving after the box is already cut off
Charted byProtected endpoint, monthly
Soundingper protected endpoint
taken each month, always up frontQTY
Fortify-MDR-K8Line sheet

Managed Detection, Kubernetes Node

SentinelOne, keeping watch over container workloads

Grade one over containerised workloads. Nodes are the unit, so the quantity on your invoice is a figure your platform engineers recognise already.

  • One node, one agent, covering everything scheduled onto it.
  • Identical watch desk, identical triage, identical case flow to the endpoint codes.
  • Sight of how containers actually behave at runtime, not image scanning by itself.
Piloted onSentinelOne for Kubernetes
SoundsRuntime conduct of whatever is scheduled onto the node
Logged forInvestigation history, kept readable in the chart room
Handed toFortify 24x7 watch, any hour of the day
Charted byKubernetes node, monthly
Soundingper Kubernetes node
taken each month, always up frontQTY
Fortify-XDR-K8Line sheet

Extended Detection, Kubernetes Node

SentinelOne on the nodes, roped into the company by Fluency

Grade two for the cluster. Correlation is switched on, putting cluster activity beside identity records and endpoint events instead of alone inside one more window.

  • Node telemetry roped in with everything else your company generates.
  • Findings stretching from a workload across to whichever identity reached it.
  • Retention stretched over cluster and endpoint sources side by side.
Piloted onSentinelOne for Kubernetes, with Fluency correlation
SoundsNode runtime read beside identity, endpoint, and network
Logged forLonger retention holding cluster and endpoint together
Handed toFortify 24x7 watch, any hour of the day
Charted byKubernetes node, monthly
Soundingper Kubernetes node
taken each month, always up frontQTY
Fortify-XDR+K8Line sheet

Response Tier, Kubernetes Node

SentinelOne, shutting down container workloads on its own authority

Grade three for the cluster, meant for production you cannot leave misbehaving until Monday morning because somebody has to look at it first.

  • A workload past the conviction threshold gets shut down without waiting.
  • Cluster, identity, and endpoint material gets assembled into a single case.
  • A person examines each automated action, records it, and sends it over.
Piloted onSentinelOne for Kubernetes, running automated response
SoundsWorkload runtime, plus the correlated company around it
Logged forEvery automated action, examined afterward and sent over
Handed toFortify 24x7 engineers, arriving after the workload is already stopped
Charted byKubernetes node, monthly
Soundingper Kubernetes node
taken each month, always up frontQTY
Honest scope

Where this chart runs out of water

Watchkeeping makes for a firm control and a poor guarantee. Below is whatever these six codes will not reach, so the remainder of the passage can be planned around it.

  • Watching does not prevent. An agent identifying an intrusion is telling you an intrusion has begun. The speed of whatever happens next is the thing being bought. No supplier anywhere offers a guarantee that nothing ever begins, and we are not about to pose as the exception.
  • Software written inside your company is out of scope. Flaws in an application your own developers ship are invisible from an endpoint. Testing an application and reviewing its code are a different trade with different practitioners, and naming that trade beats letting this pass as cover.
  • Nothing comes back from a machine with no agent. Where nothing was ever enrolled, there is no telemetry to read, no evidence to work from, and no line on this chart that applies, whatever an inventory spreadsheet claims.
  • Rolling back and restoring are separate things. Grade three unwinds whatever a convicted process changed, on platforms permitting it. It cannot produce last quarter's copy of a spreadsheet, and it cannot rebuild a controller whose disks have gone. Look at the anchorage chart for that.
  • The cluster lines stop at the node. How the cluster is architected, how role bindings are written, how secrets are handled, and what your admission policy permits are all yours to decide. An opinion is available whenever you want one. The wheel stays yours.
NOTE 01

Heads up: card statements show FORTIFY 24X7 - Independence IT Group is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.

Chart 03Detection and watchkeepingChart 04Execution controlChart 05Mailbox signal trafficChart 06Device fleet pilotageChart 07Data cargo controlChart 08Backup and anchorage
All lines, with ratesThe six stationsChart roomOpen the catalog