Detection is not a screen anybody is supposed to glance at between patients. It is an agent reading conduct on the hardware, a layer tying that reading to the rest of what a practice does, and a person taking the decision while the building stands empty. Every one of the lines below brings all three of those with it.
Recognising a signature you have met before stopped being enough a long while back, and against something built for one practice it never helped at all. What the SentinelOne agent does instead is watch conduct on the hardware. Which process launched which. What got opened. Where it tried to reach. Whether the pattern looks like encrypting, or harvesting, or working across a network at a very patient pace. All of that continues with no network present, which counts for the laptop a clinician carried home, and equally for the spare in the back office that has been asleep since spring.
Fluency gathers up what the agents say and lays it against every other thing worth knowing. Sign in records. Mail movement. Connections the network noticed. Output from instruments your practice already pays for. An alert reaching our bench therefore carries its own surroundings, and that is what separates being handed a warning from being handed a decision. The separation is what you are paying us for.
Line one sorts and counsels. The extended line draws further sources into one reading, so an unusual sign in recorded here and an unusual process recorded there cease to be two curiosities living in two consoles. The response tier bolts on containment and reversal, and that is the tier you want when trouble starts late on a Saturday with the doors opening at seven.
Nodes get billed by themselves. A node bears no resemblance to a reception machine, the agent sits upon it differently, and adding nodes into an endpoint total prints a figure on your invoice which says less than it looks like saying. Count nodes. Pods never.
The figures underneath arrive from billing itself. Hang something on the ring and it waits there for as long as you go on reading.
Conduct is read on the hardware where the work is done, and a staffed bench stands behind that reading. You get a conclusion and a suggested next move, rather than a chart nobody has time to decipher between appointments.
| Cut for | Workstations, laptops and servers that hold or reach patient data |
|---|---|
| Turns on | SentinelOne, with Fluency reading alongside |
| Held in | The vendor platform. Your retention window is put in writing at fitting. |
| Rekeyed | Detection content updates from the vendor; tuning with you over the opening weeks |
| Master level | Held by the Fortify 24x7 bench, whatever the clock says |
All of what the detection line does, except that sign in records, mail events and network traffic are now read beside the machine rather than left in four separate windows nobody in a busy practice ever opens.
| Cut for | The same protected machines, with more sources joined to them |
|---|---|
| Turns on | SentinelOne with extended Fluency correlation |
| Held in | Correlated events in Fluency; the window is confirmed to you in writing |
| Rekeyed | Sources are added or dropped whenever your estate changes shape |
| Master level | Held by the Fortify 24x7 bench, whatever the clock says |
The correlated tier, plus containment that fires by itself. Where something convicts in the small hours, the device is severed from the network and its alterations undone, with nobody standing by for a human to wake and consent.
| Cut for | Machines where an hour of waiting is an hour too many |
|---|---|
| Turns on | SentinelOne with response actions enabled |
| Held in | Action history in the platform, mirrored into the case on your portal |
| Rekeyed | Containment thresholds reviewed with you after the first weeks of live running |
| Master level | Held by the Fortify 24x7 bench, whatever the clock says |
The detection line, cut for a Kubernetes node instead of a desktop. The agent watches containers together with the host underneath them, and the same bench works whatever comes out.
| Cut for | Kubernetes worker and control plane nodes |
|---|---|
| Turns on | SentinelOne, Kubernetes agent |
| Held in | The vendor platform, under terms matching your endpoint lines |
| Rekeyed | Agent versions tracked against your cluster upgrades |
| Master level | Held by the Fortify 24x7 bench, whatever the clock says |
Node detection with the broader correlation attached, so cluster behaviour gets read next to sign in and network evidence instead of being studied by itself.
| Cut for | Nodes in clusters that carry or reach clinical workloads |
|---|---|
| Turns on | SentinelOne Kubernetes agent with Fluency correlation |
| Held in | Correlated events in Fluency, alongside your endpoint sources |
| Rekeyed | Correlation sources revisited whenever the cluster is rebuilt |
| Master level | Held by the Fortify 24x7 bench, whatever the clock says |
The node line with response actions turned on. Containment on a node is a heavier decision than containment on a laptop, so the thresholds are agreed with you before anything is armed.
| Cut for | Nodes where automatic containment is a decision you want made for you |
|---|---|
| Turns on | SentinelOne Kubernetes agent with response actions enabled |
| Held in | Action history in the platform, mirrored into your portal |
| Rekeyed | Thresholds reviewed with you after every cluster change of substance |
| Master level | Held by the Fortify 24x7 bench, whatever the clock says |
As a control, detection is worth every penny. As a promise it is worth nothing. The five items beneath mark the edge of what these six lines touch, so you can weigh up the remainder yourself.
Heads up: card statements show FORTIFY 24X7 - Health Lock Solutions is a Fortify 24x7 brand, and your subscription is billed by Fortify 24x7.