MSSP Program

Complete Protection Platform (Per Workstation/Per Pod or Task/Per Server).

EPP + EDR, with NGAV (AI), Rogues IoT, Firewall Control, Device Control, Remote Shell, Deep Visibility and up to 100 concurrent STAR Rules, Standard Support Plan.

Control Protection Platform (Per Workstation/Per Pod or Task/Per Server).

EPP with NGAV (AI), Device & App Inventory, Firewall Control, Device Control, Remote Shell, Standard Support.

Network Discovery is an Enterprise-wide Discovery of IT/IoT, Attack Surface Reduction, Peer-to-Peer Deployment Capability for SentinelOne Agents.

Network Discovery is activated at site level, so that the partner can differentiate per customer. Network Discovery can only be purchased when the customer already has Control or Complete. The price is calculated based on the total number of licenses per site.

Former Ranger Attack Surface Management Platform (per Endpoint).

30 Day Data Retention (Per Endpoint).

Data retention Extension for Deep Visibility from 14 days to 30 days.

Data Retention is activated at the account level - it can not be done at site level. Therefore, a partner cannot differentiate per customer but will buy for all or no customers.

Data Retention can only be used with Complete licenses.

The price is calculated based on the partner's total number of Complete licenses. This can be purchased/cancelled as usual on XOD, but data disappears the moment you choose to cancel.

90 Day Data Retention (Per Endpoint).

Data retention Extension for Deep Visibility from 14 days to 90 days.

Data Retention is activated at the account level - it can not be done at site level. Therefore, a partner cannot differentiate per customer but will buy for all or no customers.

Data Retention can only be used with Complete licenses.

The price is calculated based on the partner's total number of Complete licenses. This can be purchased/cancelled as usual on XOD, but data disappears the moment you choose to cancel.

180 Day Data Retention (Per Endpoint).

Data retention Extension for Deep Visibility from 14 days to 180 days.

Data Retention is activated at the account level - it can not be done at site level. Therefore, a partner cannot differentiate per customer but will buy for all or no customers.

Data Retention can only be used with Complete licenses.

The price is calculated based on the partner's total number of Complete licenses. This can be purchased/cancelled as usual on XOD, but data disappears the moment you choose to cancel.

365 Day Data Retention (Per Endpoint).

Data retention Extension for Deep Visibility from 14 days to 365 days.

Data Retention is activated at the account level - it can not be done at site level. Therefore, a partner cannot differentiate per customer but will buy for all or no customers.

Data Retention can only be used with Complete licenses.

The price is calculated based on the partner's total number of Complete licenses. This can be purchased/cancelled as usual on XOD, but data disappears the moment you choose to cancel.

Wayfinder MDR Essentials (Per Endpoint) - Former Vigilance MDR

Wayfinder MDR Essentials by SentinelOne is a managed detection and response service built on the Singularity Platform. It combines AI-powered threat detection with 24/7 expert monitoring and investigation.

The service delivers rapid threat containment and guided remediation to minimize business impact. Wayfinder MDR Essentials helps organizations strengthen security operations without expanding internal SOC resources.
Wayfinder MDR Essentials is activated at either account or site level.

Requires either a Control or Complete license to be deployed. The total price is calculated based on the total number of agents per site where Wayfinder MDR Essentials is enabled.

Requires a Complete license. Singularity RemoteOps RSO is a remote orchestration tool that enables security teams to orchestrate forensics, conduct investigations across multiple endpoints, and automate response workflows.  RemoteOps is the ability to run (factory delivered/custom) program script directly on an endpoint without the need to run a remote Shell/console on the protected endpoints.

Mainly used by IT/Device Admins/ or SecOps teams.  The service can be enabled or disabled at Account and Site-level during Account or Site creation, or by editing the account or site container. RemoteShell provides direct CLI access on the endpoint (CMD, Bash or PowerShell Console) and requires a minimum of SKU “Control or Complete” activated on the endpoint.

Requires a Complete license. Singularity RemoteOps Forensics is your integrated digital forensics solution that automates and customizes the collection of forensic evidence. Accelerate deep investigations with context, perform customized forensic collection at scale, and simplify workloads, reducing time to respond. s. RemoteOps empowers security teams to efficiently protect their enterprise from time-sensitive threats.

RemoteOps Forensics is built upon the existing RemoteOps solution and includes all of its features, including the ability to perform customized mitigation actions and data collection across one or multiple assets. This is all still delivered with the existing SentinelOne agent, eliminating the need to deploy and provision an additional tool.

Singularity Cloud Funnel ( per EndPoint)  streams EDR and XDR data to Amazon S3 or Google Cloud Storage buckets for data storage, integration with SIEM and SOAR tools, correlation with outside data sources, and other security workflows. The service can be enabled or disabled at Account and Site-level . CLoudFunnel is an addon to Complete license SKU.

Singularity Identity Posture Management ( Per User)  is an identity configuration assessment solution that identifies misconfigurations, vulnerabilities, and active threats targeting Active Directory and Entra ID. By delivering prescriptive, actionable insight into exposures in your identity attack surface, Singularity Identity Posture Management helps you reduce the risk of compromise and brings your assets in line with security best practices. The service can be enabled or disabled at Account and Site-level.

Singularity Identity for IdPs (Per User). Cloud-based, real-time Active Directory and Azure AD attack surface monitoring and reduction further supplemented with domain controller-based Identity Threat Detection and Response.

Singularity Identity Detection & Response ( per Endpoint) , a component of the SentinelOne Singularity Platform, defends Active Directory and domain-joined endpoints, in real-time, from adversaries aiming to gain privilege and move covertly.

Singularity Identity Detection & Response expands on Singularity Platform protection capabilities with Sentinel agents that safeguard Microsoft AD domain controllers and end-user endpoints. The service can be enabled or disabled at Account and Site-level.

Risk & Vulnerability Management ( per Endpoint) by SentinelOne combines executive insights with a prioritized list of vulnerable applications for the IT team to execute their patch management program. Risk scoring includesinformative details and links to help facilitate resolution.  The service can be enabled or disabled at Account and Site-level .

Vulnerability Management can only be purchased when the customer already has Control or Complete.

Wayfinder Threat Hunting (Per Endpoint) - Former Watchtower.

Wayfinder Threat Hunting by SentinelOne is an advanced threat hunting capability within the Singularity Platform.

It provides deep visibility across endpoints and cloud workloads with powerful query and behavioral analytics.

Security teams can proactively detect sophisticated threats, investigate faster, and respond with automated remediation.

Wayfinder helps reduce dwell time and strengthen overall security posture.

Wayfinder Threat Hunting is activated at either account or site level.
Requires either a Control or Complete license to be deployed.

The total price is calculated based on the total number of agents per site where Wayfinder Threat Hunting is enabled.

Singularity Threat Intelligence ( per Endpoint) - powered by industry-leading threat intelligence from Mandiant – provides a deeper understanding of your threat landscape, monitoring emerging threats to proactively reduce risk and identify adversaries in your environment. Unlock SecOps efficiency  with high fidelity detections, adversary context for more thorough investiguation and optimized threat hunting workflows. The service can be enabled or disabled at Account and Site-level . THreat Intelligence is an addon to Complete license SKU.

Control Protection Platform (Per Container Host).

EPP with NGAV (AI), Device & App Inventory, Firewall Control, Device Control, Remote Shell, Standard Support.

Complete Protection Platform (Per Container Host).

EPP + EDR, with NGAV (AI), Rogues IoT, Firewall Control, Device Control, Remote Shell, Deep Visibility and up to 100 concurrent STAR Rules, Standard Support Plan.

Purple AI, the industry's leading AI security analyst, is designed to support this journey by providing agentic AI that combines reasoning and decision-making to act as a force multiplier for analysts—not just answering questions, but taking informed action to complement human expertise. Features SOC Analyst version

Community Verdict: Eliminate silos with global analysis
Auto-Triage: Reduce Triage Time with prioritized alerts
Auto-Investigation: Reduce Investigation Time with automated evidence collection

Cloud Native Security (CNS) is an agentless CNAPP solution with a unique offensive engine that prioritizes vulnerabilities that are truly exploitable. Unlike other solutions that only list all theoretically exploitable alerts, CNS provides evidence of exploitability with every vulnerability to save time spent by security teams on validation and prioritization of alerts. Combine it with the AI-powered threat blocking of SentinelOne's agent-based Cloud Workload Security and organizations have a comprehensive security solution for their cloud environment.

Cloud Native Security (CNS) is an agentless CNAPP solution with a unique offensive engine that prioritizes vulnerabilities that are truly exploitable. Unlike other solutions that only list all theoretically exploitable alerts, CNS provides evidence of exploitability with every vulnerability to save time spent by security teams on validation and prioritization of alerts. Combine it with the AI-powered threat blocking of SentinelOne's agent-based Cloud Workload Security and organizations have a comprehensive security solution for their cloud environment.

Pro version with Secret Scanning, IaC Scanning and Auto Remediation

Singularity Hyperautomation is a powerful no-code automation solution designed to streamline security operations, accelerate threat response, and boost operational efficiency for security teams. Hyperautomation is built into the Singularity Platform, and connects to any SaaS application to automate workflows without complex configure.

Singularity Data Lake for Log Analytics enables IT and DevOps teams to seamlessly ingest data from their on-prem, cloud or hybrid environments. Capture and analyze 100% of your event data for monitoring, analytics, and new operational insights. Detect and resolve incidents in real time. Comes with 14 days data retention.

Singularity Data Lake for Log Analytics enables IT and DevOps teams to seamlessly ingest data from their on-prem, cloud or hybrid environments. Capture and analyze 100% of your event data for monitoring, analytics, and new operational insights. Detect and resolve incidents in real time. Comes with 30 days data retention.

Singularity Data Lake for Log Analytics enables IT and DevOps teams to seamlessly ingest data from their on-prem, cloud or hybrid environments. Capture and analyze 100% of your event data for monitoring, analytics, and new operational insights. Detect and resolve incidents in real time. Comes with 90 days data retention.

Singularity Data Lake for Log Analytics enables IT and DevOps teams to seamlessly ingest data from their on-prem, cloud or hybrid environments. Capture and analyze 100% of your event data for monitoring, analytics, and new operational insights. Detect and resolve incidents in real time. COmes with 180 days of data retention.

Singularity Data Lake for Log Analytics enables IT and DevOps teams to seamlessly ingest data from their on-prem, cloud or hybrid environments. Capture and analyze 100% of your event data for monitoring, analytics, and new operational insights. Detect and resolve incidents in real time. COmes with 365 days of data retention.