Managed detection and response

Nothing about this step is chain specific.

The compromise that empties an account rarely involves cryptography at all. Something runs on a machine that holds a hot wallet, a browser profile, or the companion application for a hardware device. From there it enumerates the obvious: keystore files by extension, extension storage directories, the clipboard, saved session cookies, and anything in a downloads folder that resembles a recovery export.

That step is the last one that leaves evidence on hardware you own. Everything after it is somebody else's ledger and none of your business to undo. So the detection question is narrow and answerable: did an unfamiliar process touch the things that matter, and how long did it take somebody to notice.

Behavior on the device, decided on the device.

The SentinelOne agent runs static and behavioral engines locally. Verdicts are reached locally rather than fetched, which matters for a laptop on conference wifi, a tethered handset, or an air gapped signing host that never leaves a desk. A payload compiled an hour ago has no reputation anywhere, and that is exactly the case behavioral detection exists for.

Activity is tracked as a storyline rather than a list of events. Parent process, spawned child, injected thread, file written, key set, socket opened, all linked. A loader that drops a second stage and executes it is recognized by the shape of that sequence. On Windows the mitigation options include kill, quarantine, and rollback of file changes attributed to the storyline.

• Static and behavioral analysis with no dependence on a network connection to decide.
• Full process lineage retained, so the answer to what else did it touch is a query rather than a reconstruction.
• Device isolation from the console, which cuts a suspect host off the network without anyone walking to it.

A pipeline and a person, not a mailbox rule.

Endpoint telemetry lands in a correlation pipeline alongside mail and identity events, where detections are mapped to technique rather than left as vendor jargon. Analysts work the queue continuously. When something crosses the line, the escalation goes to a human on your side, and the case record afterward is a written account of what ran, what it reached, and how it was ended.

The distinction between the tiers below is entirely about who acts. On the monitoring tier we tell you. On the remediation tier we act first and tell you after, which is the right arrangement for a desk that cannot guarantee somebody is awake at four in the morning.

Which tier you actually need.