SentinelOne Singularity

What is this product?

An EDR that ties device activity into a connected Storyline, and can disconnect a machine from the network or, in some cases, roll back file encryption.

About the company

A US company founded in 2013, focused on automated endpoint detection and response without waiting for a human decision at every step.

What does an analyst do inside it?

• Follows the Storyline to see everything the suspicious process did.
• Searches with fields such as `src.process.name` and `endpoint.name`.
• Adds an indicator to the blocklist.
• Marks the detection a false positive when the activity is legitimate.

Its search language

These examples are written in the syntax the product itself accepts.

• endpoint.name: FIN-WS-014
• src.process.name: powershell.exe

The field names it uses

• endpoint.name
• src.process.user
• src.process.name
• src.process.parent.name
• src.process.cmdline
• src.process.image.sha256
• src.ip.address
• dst.ip.address
• event.type
• indicator.category

Where does it show up in the job market?

Common at mid-sized and large companies, often deployed as an alternative to CrowdStrike, so knowing it widens your options.

Tools in the same category

• CrowdStrike Falcon
• Microsoft Defender for Endpoint