Yes, SentinelOne supports threat hunting using MITRE ATT&CK Tactics, Techniques, and Procedures (TTP)s , the behavioral indicators mapped by the MITRE framework, to help analysts understand the behavior of your endpoints and accurately detect and respond to any anomalous activity. This feature helps uplevel analysts skills and makes the EDR user experience more satisfying and efficient from day one.

Yes. SentinelOne Cloud Funnel is an implementation of Kafka that enables customers to subscribe to their data set and pull that data into their cloud to be used for whatever purpose they desire.

SentinelOne enables effective threat hunting with an industry leading data retention of 365 days out of the box for malware and fileless attack incidents. We offer 14 days standard historical EDR data retention that is affordably upgradeable to 365 days.

SentinelOne’s ActiveEDR intelligently automates EDR by providing Storyline context (shown in MITRE ATT&CK Phase 2 testing) and a full range of automated and manual remediation actions. Devices defend themselves autonomously by killing and quarantining unauthorized processes and files in real-time. Devices also heal themselves with surgical, automated remediation and rollback to help reduce Mean Time to Remediate (MTTR). Threat hunters and incident responders can also use these functions to mark identified suspicious situations as threats for automatic, estate-wide remediation which greatly increases responder efficiency.

SentinelOne continuously monitors every event, across every OS and every environment, whether data center, cloud service provider, office, or remote work location to accurately identify threats and correlate the information to provide automated context and complete attack story. This was shown in the last MITRE ATT&CK Phase 2 test (APT29), where SentinelOne had the lowest number of misses and the highest number of correlated tactics and techniques.