A Fortify 24x7 brand, looking after the computers, records and back office a small firm trades on.Sign inTalk to the board
CyberSec Managed
Position 01 / Detection desk

Something is always running. What matters is whether a person notices.

This is not a screen you are meant to glance at between customers. Three things make it up. Software on the machine, which understands what a program is doing. A layer that stitches the result to everything else running. And a person who decides, at four in the morning, what happens next. Every circuit here brings all three.

SentinelOneFluencyA staffed board
6 circuits wired at this position
On the board6
EquipmentSentinelOne + Fluency
Charged byEndpoint or node
BoardContinuously staffed

What the software is weighing up

Checking a program against a list of the bad ones already known stopped being enough years ago, because they get rebuilt faster than any list gets refreshed. The SentinelOne agent models conduct on the machine: which process spawned what, which files were opened, which addresses were dialled, and whether the resulting shape resembles encryption, hoarding, or somebody strolling around a network.

Pull the cable and it carries on deciding, which matters for a laptop in an airport and for the machine in the stock room nobody has touched since spring. Fluency then binds what the agents report to login records, post records and traffic records, so an alarm rings with enough attached to be decided rather than merely noted.

Picking among the three grades

The detection circuit watches, sorts and advises. The extended circuit widens what gets correlated, so an odd login over here and an odd program over there stop reading as two separate curiosities. The response grade brings containment and it brings rollback, which is what the payroll machine wants when something kicks off on a Sunday night.

Kubernetes gets circuits of its own. Nodes and laptops have nothing in common, the agent sits on a node differently, and counting one as an endpoint would falsify the invoice quietly. Nodes are the unit. Pods are not.

An alarm arriving without its context is a chore. One arriving with it is a decision somebody can actually make.
Jacks on this position

Write ups and rates

Prices below arrive straight out of billing. Whatever gets patched in waits on the list while you read on.

Fortify-MDRWrite up

Managed Detection and Response

SentinelOne at the jack, Fluency keeping the log, our operators taking the call

Software goes onto each computer you enroll. Its job is to weigh up behaviour: what a program did, not what it claimed to be. Bad behaviour rings through to us. An operator has already picked up and looked before anything reaches your phone.

  • Windows, macOS, Linux: the same agent, still weighing things up with the network gone.
  • You never receive a raw alarm. It gets worked, then explained in language you can use.
  • Incident and outcome both stay readable in the account portal afterwards.
Patched toSentinelOne, and Fluency to keep the log
Listens onProgram behaviour, files touched, and outbound connections from the machine
Line heldIncident history, kept and readable from the portal
Answered byFortify 24x7 operators, whatever the clock says
Traced byOne protected endpoint, charged monthly
Readingper protected endpoint
payable in advance, monthlyQTY
Fortify-XDRWrite up

Extended Detection Across Layers

SentinelOne, widened across your other records by Fluency

Same watching, wider aperture. A login nobody in the building made and a peculiar program on a laptop are two shrugs on their own. Read together they become one account of what happened, in order, with a start point.

  • Machine activity gets weighed beside logins, beside post, beside network traffic.
  • Surfaces a pattern that no single agent could have seen on its own evidence.
  • Keeps records longer, since a fair amount of trouble only makes sense in hindsight.
Patched toSentinelOne, widened by Fluency over other sources
Listens onMachines, logins, mail and network traffic, weighed together
Line heldLonger retention, so a week from a while back can still be gone through
Answered byFortify 24x7 operators, whatever the clock says
Traced byOne protected endpoint, charged monthly
Readingper protected endpoint
payable in advance, monthlyQTY
Fortify-XDR+Write up

Extended Detection with Response

SentinelOne, wired up to act on its own

Now the software has hands. Cross the threshold and the computer comes off the network and gets rolled back, while an operator is partway through reading the file. Worth having on the machine that runs your payroll and the one wired to the card reader.

  • The machine is isolated automatically once conviction is confident enough to justify it.
  • Alterations made by a convicted program get undone, where the system allows undoing.
  • A human checks each automatic action after the event and records what was carried out.
Patched toSentinelOne, wired up to contain and roll back
Listens onMachines, logins, mail and network traffic, weighed together
Line heldEach automatic action written down and retained
Answered bySoftware first, then a person who audits what the software did
Traced byOne protected endpoint, charged monthly
Readingper protected endpoint
payable in advance, monthlyQTY
Fortify-MDR-K8Write up

Managed Detection, Kubernetes Node

SentinelOne, watching container workloads at the node

Firms running containers get watched at the node. Billing counts nodes, a figure your own engineer can already recite, which keeps the invoice checkable instead of being a number somebody estimated on your behalf.

  • Software at node level, covering whatever the scheduler puts onto that node.
  • Same operators, same triage, same paperwork as the ordinary computer circuits.
  • Watches container conduct as it happens, not merely what the image held at build time.
Patched toSentinelOne for Kubernetes
Listens onConduct of the workloads the scheduler places on that node
Line heldIncident history, kept and readable from the portal
Answered byFortify 24x7 operators, whatever the clock says
Traced byOne Kubernetes node, charged monthly
Readingper Kubernetes node
payable in advance, monthlyQTY
Fortify-XDR-K8Write up

Extended Detection, Kubernetes Node

SentinelOne at the node, wired through Fluency to everything else

Node watching, correlation switched on. Cluster activity gets weighed beside the account that reached in and the laptop that account was driven from, which is usually where the interesting part of the story turns out to live.

  • Node records correlated inside Fluency against the rest of what you operate.
  • Findings that span a workload and whichever identity got hold of it.
  • Retention stretched over cluster machines and office machines at once.
Patched toSentinelOne for Kubernetes, wired through Fluency
Listens onNode conduct beside login, machine and network records
Line heldLonger retention over cluster and office machines together
Answered byFortify 24x7 operators, whatever the clock says
Traced byOne Kubernetes node, charged monthly
Readingper Kubernetes node
payable in advance, monthlyQTY
Fortify-XDR+K8Write up

Response Tier, Kubernetes Node

SentinelOne, shutting a container workload down without asking first

The node circuit with hands attached. For a cluster carrying work that cannot sit misbehaving from Friday night until Monday. Containment first, audit by a person second.

  • A workload past the response threshold gets contained automatically.
  • One joined up file, assembled from cluster evidence, identity evidence, machine evidence.
  • A human checks each automatic action after the event and sends you the write up.
Patched toSentinelOne for Kubernetes, wired up to contain
Listens onNode conduct beside login, machine and network records
Line heldEach automatic action written down and retained
Answered bySoftware first, then a person who audits what the software did
Traced byOne Kubernetes node, charged monthly
Readingper Kubernetes node
payable in advance, monthlyQTY
Plain limits

Calls we cannot take

This position earns its keep and it has edges. Set out below is the ground these circuits leave uncovered, plainly enough to plan around.

  • Detection does not prevent. Recognising an intrusion amounts to reporting something already in motion. Speed of answer is the purchase. No supplier anywhere sells a guarantee that nothing begins, at any price.
  • No response time appears on this page. No headline figure about minutes exists here. Put the question in writing, naming your circuits and your hours, and a straight answer comes back that we will stand behind.
  • A machine without the agent produces nothing. Computers that never enrol emit no records, feature in no investigation, and are covered by nothing on this position. The laptop somebody uses at home and never mentioned falls in that category.
  • Rollback and backup are different things. On systems that allow reversal, the response grade undoes alterations a convicted program made. Dead drives it will not return, nor a document as it read a month ago. That belongs to the copy and restore position.
  • Kubernetes circuits stop at the node. Getting cluster design right stays with you. So do role bindings, the handling of secrets, and admission policy. We will offer a view when asked. We do not own them.
NOTICE

Heads up: card statements show FORTIFY 24X7 - CyberSec Managed is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.

Position 01Detection deskPosition 02Allowlist controlPosition 03Mailbox linePosition 04Device boardPosition 05Data discoveryPosition 06Copy and restore
Every circuit and rateSix positionsAccount portalOpen the rates