One key, one invoice, one desk. A Fortify 24x7 brand.Account sign inReach an engineer
Iconic IT Innovations
Plate 01 / Detection and response

Detection you do not crew is a subscription to bad news.

Owning a detection product and running a detection function are separate purchases, and only the second one is any use at two in the morning. Every line here ships with the agent on the machine, the correlation sitting above it, and the people who decide what gets done. Nothing in it is a screen that somebody quietly hopes you will watch.

SentinelOneFluencyCrewed deskMachines and nodes
6 lines / SentinelOne and Fluency
Lines on this plate6
PlatformsSentinelOne and Fluency
Measured inEndpoint or node
DeskCrewed every hour of the week

What the agent is weighing up

Recognising a known sample has not been enough for years, and it was never worth much on hardware that spends its week nowhere near your network. The SentinelOne agent builds a picture of what a program is doing where it is doing it: what it launched, what it opened, who it called, and whether the resulting shape reads as scrambling files, hoovering them up, or somebody moving sideways with no hurry at all. None of that reasoning needs a connection, exactly the property you need on a laptop over the Atlantic and on a terminal wired to a packing line.

Fluency then ties what the agents saw to everything else in the building: authentication records, message events, traffic, and logs from products you are already paying for. A case that arrives at our desk carrying its surroundings can be decided in minutes. A case that arrives on its own becomes a research task, and research tasks form a queue.

A case arriving with its surroundings gets decided in minutes. A case arriving on its own turns into a research task.

Choosing among the three tiers

The first line sorts and recommends. The second opens up what gets pulled together, so a peculiar authentication on one continent and a strange binary on a laptop somewhere else cease to be two unrelated curiosities logged by two unrelated people. The third acts without being asked, which suits hardware where an hour of waiting costs real money.

Containers are metered separately for a reason. A node is not a desk, the agent behaves differently on it, and counting a node as though it were a desk would produce an invoice that lies wrong. Meter nodes. Never meter pods.

Lines on this plate

Detail and rates

Every rate below is fetched from billing the moment this page opens. Whatever gets marked waits in the schedule; reading on costs you nothing.

Fortify-MDRSign spec

Managed Detection and Response

Conviction at the endpoint, correlation over it, analysts behind both

Conviction happens on the machine. Judgement happens at a crewed operations desk. You are sold both. That is why a finding turns up recommending something, instead of as a chart somebody expects you to decode before your first coffee.

  • Coverage spans Windows, macOS and Linux, and judgement survives a severed link.
  • Fortify 24x7 engineers do the sorting, the investigating and the escalating.
  • Findings and their working are readable from your account area whenever you want them.
PlatformSentinelOne, correlated by Fluency
Applies toWindows, macOS, Linux
ResponseTold, advised, and helped to remediate
Without a linkJudgement continues with no network present
DeskCrewed at Fortify 24x7 every hour of the week
Measured inProtected endpoint, each month
Readingper protected endpoint
charged ahead of each monthQTY
Fortify-XDRSign spec

Extended Detection Across Layers

Widened out through Fluency, same agent underneath

Take the previous line and open the aperture. Sign in records, message events and network flow get read beside what the agent saw, rather than sitting in three consoles owned by three people who compare notes on Thursdays.

  • Machine evidence stitched to authentication records, message events and traffic.
  • Conclusions no lone agent could reach from the evidence in front of it.
  • A deeper archive, because plenty of questions only answer themselves later.
PlatformSentinelOne, widened through Fluency
Draws onMachines, identity, messaging, traffic
ResponseTold, advised, and helped to remediate
ArchiveDeepened, so a window can be re-examined later
SuitsEstates already gathered into one Microsoft or Google tenant
Measured inProtected endpoint, each month
Readingper protected endpoint
charged ahead of each monthQTY
Fortify-XDR+Sign spec

Extended Detection with Response

Correlated, and cleared to act on its own conclusions

The widened tier, given permission to act. Cross the threshold and the machine is cut off and put back the way it was while an engineer is still opening the case file, not once the case file has been read.

  • The network interface is dropped as soon as confidence is high enough to justify it.
  • Whatever the ruled against process altered is put back, where the platform supports it.
  • Each unattended action gets audited afterwards by a person who writes it up.
PlatformSentinelOne, acting unattended
Cutting offThe affected machine loses its network interface
Putting backChanges made by a ruled against process are reversed where supported
AuditEach unattended action is checked by a person afterwards
SuitsFinance workstations, plant controllers, signing hosts
Measured inProtected endpoint, each month
Readingper protected endpoint
charged ahead of each monthQTY
Fortify-MDR-K8Sign spec

Managed Detection, Kubernetes Node

Container workloads, watched at the node

The same discipline pointed at containers, and metered by node so the bill agrees with a figure your platform team can quote off the top of their heads.

  • An agent per node, covering whatever the scheduler places on it.
  • Identical desk, identical sorting, identical case flow to the machine lines.
  • Behaviour at runtime, which is a different question from scanning an image.
PlatformSentinelOne for Kubernetes
WatchesThe behaviour of workloads once the scheduler has placed them
ResponseTold, advised, and helped to remediate
DeskCrewed at Fortify 24x7 every hour of the week
Measured inKubernetes node, each month
Readingper Kubernetes node
charged ahead of each monthQTY
Fortify-XDR-K8Sign spec

Extended Detection, Kubernetes Node

Nodes wired into the wider correlation layer

Node coverage, aperture open. Cluster activity gets read alongside authentication and machine evidence, so whoever is on call is not investigating in a vacuum at three in the morning.

  • Node evidence lined up with everything else the estate produced, inside Fluency.
  • Conclusions spanning both a workload and whoever authenticated near it.
  • One deepened archive covering cluster and machine evidence at once.
PlatformSentinelOne for Kubernetes, tied together by Fluency
Draws onNode runtime, identity, machines, traffic
ResponseTold, advised, and helped to remediate
ArchiveDeepened, so a window can be re-examined later
Measured inKubernetes node, each month
Readingper Kubernetes node
charged ahead of each monthQTY
Fortify-XDR+K8Sign spec

Response Tier, Kubernetes Node

Container workloads shut down unaided

Node coverage cleared to act, for clusters where something misbehaving overnight is not survivable until the first laptop opens on Monday.

  • A workload past the threshold is shut down without anyone being woken.
  • A single case built from cluster, authentication and machine evidence.
  • Each unattended action is audited by a person, whose write up reaches you.
PlatformSentinelOne for Kubernetes, acting unattended
Shutting downUnattended action against whichever workload misbehaved
AuditEach unattended action is checked by a person afterwards
SuitsProduction clusters carrying work your customers can see
Measured inKubernetes node, each month
Readingper Kubernetes node
charged ahead of each monthQTY
Where this plate stops

The honest edge of these 6 lines.

Written down in advance, so the question of what else the estate needs gets asked now and not in the middle of something.

  • Noticing is a different job from preventing. When an agent recognises an intrusion, it is reporting that one is already under way. What you buy is how fast the next hour goes. Nobody on this market sells an assurance that nothing ever starts, and an assurance of that shape should make you suspicious of whoever offered it.
  • Hardware without the agent contributes nothing. A machine that never enrols emits no evidence, features in no case, and falls outside all six of these lines. Across several sites this is the gap that bites hardest, because the boxes nobody enrolled are rarely the boxes anybody is thinking about.
  • Putting a change back is not the same as holding a copy. The acting tier reverses alterations made by a program it ruled against, on platforms that allow it. No dead disk comes back that way, and neither does a document from two quarters ago. That work belongs to route six and is priced there.
  • Software you wrote or licensed is not covered. A defect in your own application, or in a package somebody bought, is invisible to an agent watching the operating system. Reviewing code and testing applications are their own trades with their own people, and we will name them rather than let a rate imply we cover them.
  • On containers, the rate buys the node. Cluster architecture, role binding, secret handling and whatever admission policy lets through all remain in your hands. Ask us and you get an opinion. We will not pretend a per node rate transfers the design to us.
BEFORE YOU PAY

Heads up: card statements show FORTIFY 24X7 - Iconic IT Innovations is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.

Detection and responseExecution controlMail defenseDevice fleetData protectionBackup and continuity
Rates for all 24 linesThe six routesAccount areaOpen the key