Singularity™ Network Discovery (formerly Ranger®)

What’s on Your Network?

Network Discovery Extends Sentinel Agent Function by Reporting What It Sees on Networks and Enables Blocking of Unauthorized Devices.

Network Visibility

Network Discovery learns the network in a controlled manner with one click. Customizable scanning policies help avoid violating privacy statutes in a frictionless, transparent manner.

Network Control

When unauthorized devices appear on sensitive networks, Network Discovery protects managed assets from unauthorized communications with one click.

No New Software or Hardware

Sentinels intelligently elect which agents perform the cloud delivered distributed learning. Network Discovery does not require added hardware or network changes.

Easy Implementation

No new software required. Network Discovery is part of the SentinelOne agent code base.
No network changes required. No network SPAN or TAP ports.
Build a policy and toggle it on. Admins can specify a different policy for each network and subnet if needed.
Policies provide control over scan intervals and what should be scanned and what must never be scanned.
Choose between auto-enabled scanning or require explicit permission if more control is needed over the environment.

Get a Demo

Unparalleled Visibility

Network Discovery is network efficient by intelligently electing a few Sentinel agents per subnet to participate in network mapping missions.
Elected agents passively listen for network broadcast data including ARP, DHCP, and other network observances.
Admins may customize active scan policies and specify multiple IP protocols for learning including ICMP, SNMP, UDP, TCP, SMB, and more.
Network Discovery correlate all learned information within the backend to fingerprint known and unknown devices.
Network Discovery reveals vital information about IP-enabled devices and produces inventories in seconds across your region or the globe.

Granular Control

Network Discovery device inventories reveal what is connected where and the protocols these devices listen on.
Get easy access to known device information via data collected by Network Discovery.
Find and close SentinelOne agent deployment gaps with peer-to-peer deployment.
Monitor how unknown devices communicate with managed hosts.
Isolate suspicious devices from managed devices with a click.

SentinelOne Singularity Network Discovery FAQ

Can I prevent Network Discovery from scanning home, coffee shop, and customer networks when my employees are on the road?

Absolutely yes! Network Discovery policies have several settings to maintain administrative control over what is and is not scanned. A few examples…. You can set a minimum number of Sentinel agents that must be on a subnet before the system event considers it as a possibility. If you set the number at, say 5, small home networks and coffee shops are unlikely to be scanned because you probably will never have 5 managed devices on those networks at any one time. Further, administrators can require an explicit “yes, scan this network” from within the SentinelOne Singularity console to further control what is analyzed.

Unmanaged Assets vs. Network Discovery. What’s the difference?

Unmanaged Assets and Network Discovery are both built into the agent. The capabilities differ based on the purchased license level. Unmanaged Assets is a free feature included in the Singularity Complete and Singularity Control products and informs administrators which devices on the network still require a SentinelOne agent. Network Discovery is a full-featured add-on product with multiple added network visibility, deployment and control capabilities that report on all IP-enabled device types.

I am concerned about harming Operational Technology (OT) equipment in factories, power plants, or other industrial settings all of which may run TCP/IP, SCADA, Modbus or other protocols. Or, I simply run sensitive IP-enabled equipment like healthcare equipment (blood pumps, ventilators, and others). I do not want to disrupt the network operation of this critical equipment. Can I use Network Discovery on these networks?

SentinelOne understands this concern and has built in per-network policy controls so that you can use every type of scan technique on some networks but then selectively use only certain network learning methods on others. For example, you can turn off active scan probes altogether and just rely on passive network listening on an OT network. Or, you might use passive listening plus ICMP and SNMP active scanning probes but NOT use TCP connect scans because you are worried about destabilizing certain types of control units that use IP and the SCADA protocol. These are just examples. The point is, administrators can mix and match a wide variety of scanning and passive listening techniques on a per network basis to discover what is connected where and how it is communicating.

Does Network Discovery support the gathering of asset inventories?

Yes! Singularity Network Discovery, formerly known as Singularity Ranger, will build out an asset inventory for every scanned network and let you visualize or export the data.

How does Network Discovery block unknown devices?

When an administrator chooses to block a device, that device is effectively isolated from all SentinelOne-managed Windows, Mac, and Linux hosts. This is accomplished using local network control firewall rules as enforced by the SentinelOne agent on those devices.

How will I know if a new, unknown device joins a network I consider to be sensitive?

Singularity Network Discovery, formerly known as Singularity Ranger, combines capabilities with Singularity Data Lake and Storyline Active Response Engine (STAR) to alert you when a new device without a SentinelOne agent has connected to the networks of your choice. You may then take the response of your choosing including block communications from the unknown device.

Singularity^™
Network Discovery