SentinelOne

Syncurity IR-Flow SOAR Platform Integration

SOC and IR teams find themselves drowning in constant streams of alerts, logs, and data in managing alerts and escalated incidents. Establishing repeatable process, and layering in automation and orchestration, supported by robust case management is becoming a “must have” for enterprises and MSSPs/MDRs grappling with the increasing attack surface (e.g., cloud, mobile) and sophistication of attacks.

SentinelOne and Syncurity IR-Flow SOAR Platform Integration

Leveraging the SentinelOne EPP and Syncurity IR-Flow SOAR Platform, analysts can leverage the pre-execution, on-execution, and post-execution threat convictions and response actions of SentinelOne with the workflow, automation, orchestration, and case management capabilities of the award-winning, patent-pending, Syncurity IR-Flow SOAR Platform, resulting in a seamless, scalable and dynamic architecture that dramatically reduces the time to detect, validate, contain and remediate threats.

The partnership enables joint customers to easily integrate autonomous endpoint protection into existing security architectures. The joint solution empowers enterprise Security Operations Center (SOC) and Incident Response (IR) teams to detect, assess risk and automatically block validated attacks on endpoints from a single view in conjunction with their other tools. SentinelOne provides more than 200 APIs – the most of any endpoint company – enabling customers to integrate and unify security assets within their environment.

The Syncurity IR-Flow SOAR platform integrates existing security and IT technologies, using repeatable, auditable workflows that provide a dynamic layer of connectivity between them. IR-Flow enables automation for time-consuming and/or repetitive tasks, as well as orchestration across multiple disparate systems and human-required intervention.

SentinelOne uses artificial intelligence to deliver autonomous endpoint protection and automatically eliminates threats in real time. The joint solution helps customers dramatically reduce the security risk lifecycle to identify, validate and stop damaging cyber attacks.

In addition to the robust number of APIs, the SentinelOne Syncurity IR-Flow integration provides support for more than ten proactive actions that empower security teams to better protect their environments. These actions are uniquely independent of the applications calling them, and support alert ingest, data enrichment and risk containment/remediation actions, and enable Analysts to dynamically run endpoint scans, blocking hashes, and quarantining endpoints.

Key Benefits

Easily define dynamic workflows for a variety of cyber and IT ops (e.g., patching) use cases
Ingest and triage activity, event, and alert data from SentinelOne into Syncurity IR-Flow
Enrich Alert and Incident facts like IP, hashes, filenames, URLs, process detail, machine status, etc. using SentinelOne Deep Visibility telemetry from within Syncurity IR-Flow Playbooks
Compress Alert triage time using automated playbooks, actions and interactive input
Ensure Analysts focus on for priority risks using dynamic risk scoring on every enrichment, either human or machine-initiated
Reduce containment and remediation time using orchestrated and automated Playbooks when one or more Alerts are validated and escalated to an Incident
Address real-world organizational constraints for Incident response using a combination of direct integration actions to security and IT solutions, human input, and IT ticketing
Check security policy actions from SentinelOne using easy-to-configure playbooks in Syncurity IR-Flow’s Visual Playbook Editor
Orchestrating SentinelOne convictions, including system rollback, leveraging re-usable Playbooks Tasks, tracked, managed and measured using Syncurity IR-Flow’s robust case management

Actions

The SentinelOne IR-Flow integration enables the following actions to perform prevention, detection, remediation, and forensic endpoint management tasks:

Hash Blocking – Block or unblock a file hash, or check to see if already blocked
Get Endpoint Info – Discover if an endpoint has SentinelOne agent installed, get useful metadata about host
List Processes – List the running processes on an endpoint
Quarentine – Quarantine, or remove from quarantine one or more endpoints
Scan endpoint – Scan an endpoint for dormant threats
Mitigate threat – Mitigate identified threat
Assign or update group to apply different policy

The SentinelOne IR-Flow integration is easy to make operational. All you need is:

An instance of Syncurity IR-Flow (private cloud or on-premise)
SentinelOne deployment
SentinelOne Integration Actions from the secure Syncurity Repository

Purpose Built to Prevent Tomorrow’s Threats.

Today.

Your most sensitive data lives on the endpoint and in the cloud. Protect what matters most from cyberattacks. Fortify every edge of the network with realtime autonomous protection.

Get a Demo