What’s Included
Managed Solution will deploy SentinelOne endpoint security software licenses/agents with anti-tamper protection for all workstations and servers in scope. Consultant will continuously monitor for security threats, utilizing artificial intelligence and behavioral analysis to detect and prevent both file-based and fileless attacks in real-time.
Upon detection of a threat or suspicious activity on a Client endpoint by the SentinelOne platform, Consultant shall take immediate action, including:
- Reviewing alert details and endpoint telemetry to determine the nature, severity, and scope of the threat (e.g., malware infection, ransomware attempt, unauthorized intrusion), including an assessment of affected systems, files, and potential business impact.
- Utilizing SentinelOne’s built-in tools, external threat intelligence, and industry-standard frameworks such as MITRE ATT&CK to analyze malicious files, processes, and behaviors associated with the incident in order to understand the threat’s operation, targets, and method of containment.
- Taking prompt action through the EDR platform to contain the threat, including isolating the affected endpoint from the network, terminating malicious processes, stopping suspicious services, and quarantining or deleting malicious files. Where Client has authorized automatic remediation features, the EDR may also roll back certain malicious changes, including restoring encrypted or modified files to their prior state.
- Conducting follow-up remediation to ensure full eradication of the threat and restoration of systems to a secure operational state, including additional scans, security patching, and configuration adjustments to address exploited vulnerabilities.
- Documenting all findings, actions taken, and outcomes in an incident report or ticket, and notifying Client of significant incidents in a timely manner, including a description of the threat encountered, containment and remediation actions performed, and any recommended further actions for Client.